Skyhex19

**Name of the Vulnerable Software and Affected Versions** Winter versions prior to 1.2.13 **Description** Custom CSS provided through the Brand Settings Styles field is compiled by the LESS parser and rendered without sanitization on every backend page. This allows a user with the `backend.manage branding` permission to perform a stored cross-site scripting attack against other backend users. To exploit this, an attacker must already possess trusted access to the backend with specific administrative permissions. **Recommendations** Update to version 1.2.13. Restrict the `backend.manage branding` permission to only trusted administrators and developers.

**Name of the Vulnerable Software and Affected Versions** Winter versions 1.2.10 through 1.2.12 **Description** Authenticated backend users with the `backend.manage editor` permission can store custom Markup Styles via Settings → Editor Settings → Markup Styles. These styles are compiled by the LESS parser and rendered on every backend page without sanitization, enabling stored cross-site scripting (XSS). The issue occurs within the `renderCss()` function, which failed to sanitize the compiled CSS output. **Recommendations** Update Winter versions 1.2.10 through 1.2.12 to version 1.2.13. Restrict the `backend.manage editor` permission to trusted administrators and developers only.

**Name of the Vulnerable Software and Affected Versions** Winter CMS versions prior to 1.0.477 Winter CMS versions prior to 1.1.12 Winter CMS versions prior to 1.2.12 **Description** Winter CMS, a content management system based on the Laravel PHP framework, had a flaw that allowed authenticated backend users to increase their access level within the system. This was achieved by sending specifically crafted requests to the backend, modifying the roles and permissions associated with their account. An attacker needed existing access to the backend with any user account to exploit this issue. The issue allows for privilege escalation. **Recommendations** Update to Winter CMS version 1.0.477 or later. Update to Winter CMS version 1.1.12 or later. Update to Winter CMS version 1.2.12 or later.