CVE-2022-27260 Vulnerability in npm package buttercms

Description

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

Remediation

References

https://www.youtube.com/watch?v=Tw8OhtVd-mE

http://buttercms.com

https://github.com/ButterCMS/buttercms-js

https://share.getcloudapp.com/nOuR70WB

Related Vulnerabilities

CVE-2020-10650 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2022-45689 Vulnerability in maven package cn.hutool:hutool-json

CVE-2020-26259 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2022-0639 Vulnerability in npm package url-parse

CVE-2023-39345 Vulnerability in npm package @strapi/strapi

Severity

Critical

Classification

CWE-434 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H