CyberRota Analysis
AI-GeneratedThe Winter CMS prior to version 1.2.13 is vulnerable to stored cross-site scripting (XSS) due to unsanitized custom CSS input from backend users with the appropriate permissions. This flaw allows attackers to inject malicious scripts that execute in the context of other backend users, potentially leading to data theft or unauthorized actions. Organizations using this CMS should prioritize upgrading to version 1.2.13 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting against backend users. This issue is fixed in version 1.2.13.