CVE-2023-53903
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| websitebaker | websitebaker | 2.13.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored cross-site scripting (XSS) issue in WebsiteBaker version 2.13.3. Authenticated users can upload SVG files that contain embedded JavaScript code. When these SVG files are viewed, the malicious JavaScript executes in the context of the WebsiteBaker application, allowing persistent XSS attacks. The root cause is the application's failure to properly sanitize or validate the contents of uploaded SVG files before storing and serving them. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary JavaScript code in the browsers of users who view the malicious SVG files. This can lead to session hijacking, defacement, theft of sensitive information, or other malicious actions performed on behalf of the victim user within the WebsiteBaker application. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability, you can check for the presence of uploaded SVG files containing embedded JavaScript in the media section of WebsiteBaker 2.13.3. One approach is to log in as an authenticated user and review uploaded SVG files for script tags. For example, you can download SVG files from the server and search for <script> tags using commands like: 1. wget or curl to download SVG files: curl -O http://yourwebsite/media/filename.svg 2. grep to search for script tags: grep -i '<script' filename.svg This helps identify malicious SVG files with embedded JavaScript. Additionally, monitoring HTTP requests for SVG file uploads or accesses may help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or disabling SVG file uploads for authenticated users, or implementing strict server-side validation and sanitization of SVG files to remove any embedded JavaScript before storing or serving them. Additionally, applying access controls to limit who can upload files and monitoring uploaded content for malicious scripts can reduce risk. If possible, update or patch WebsiteBaker to a version that addresses this vulnerability once available. [1]