Seoyoung-Kang

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 4.0.0-RC1 through 4.17.9 Craft CMS versions 5.0.0-RC1 through 5.9.9 **Description** Craft CMS is subject to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection via the '/actions/app/resource-js' endpoint. The issue occurs when `assetManager.cacheSourcePaths` is set to `false`. An attacker can exploit the default permissive `trustedHosts` configuration by poisoning the `Host` or `X-Forwarded-Host` header to manipulate the `$baseUrl` variable. This bypasses internal URL validation in the `actionResourceJs()` function, causing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and return it to the client with a `Content-Type: application/javascript` header. If the instance is behind a caching layer, this can lead to Web Cache Poisoning, potentially resulting in Stored XSS and Remote Code Execution (RCE) by extracting the `window.Craft.csrfTokenValue` and performing unauthorized administrative actions. **Recommendations** Update Craft CMS to version 4.18.0 or higher. Update Craft CMS to version 5.10.0 or higher. Restrict the use of the '/actions/app/resource-js' endpoint or ensure `assetManager.cacheSourcePaths` is not set to `false` as a temporary mitigation.

**Name of the Vulnerable Software and Affected Versions** Wagtail versions prior to 7.0.7 Wagtail versions prior to 7.3.2 Wagtail versions prior to 7.4 **Description** A CMS user lacking page editing permissions can access page revisions via the revision compare view by knowing the primary keys of two revisions. This may lead to the disclosure of sensitive information. **Recommendations** Update to version 7.0.7 Update to version 7.3.2 Update to version 7.4

**Name of the Vulnerable Software and Affected Versions** Wagtail versions prior to 7.0.7 Wagtail versions prior to 7.3.2 Wagtail versions prior to 7.4 **Description** A CMS user lacking page editing permissions can access the history report for a page, which may lead to the disclosure of sensitive information. **Recommendations** Update to version 7.0.7. Update to version 7.3.2. Update to version 7.4.