CyberRota Analysis
AI-GeneratedAuthenticated backend users of the Winter CMS versions 1.2.10 to 1.2.12 can exploit a vulnerability that allows them to store unsanitized custom Markup Styles, leading to stored cross-site scripting (XSS) on all backend pages. This poses a significant risk as it could enable attackers to execute malicious scripts in the context of the application, potentially compromising sensitive data. Organizations using affected versions should prioritize upgrading to version 1.2.13 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting. This issue is fixed in version 1.2.13.