A stored XSS vulnerability in Statamic CMS versions 6.0.0 through 6.2.2 permits authenticated users to execute malicious scripts, leading to potential unauthorized privilege escalation.

This vulnerability is a stored cross-site scripting (XSS) flaw occurring within the content title field. An authenticated user with content creation permissions can inject malicious JavaScript that executes when a higher-privileged user, such as a super admin, views the affected content.

The exploitation of this vulnerability poses a significant risk to the integrity and security of the administrative environment. By targeting privileged users, an attacker could potentially create new super admin accounts or perform unauthorized administrative actions, leading to a complete compromise of the CMS. With a CVSS score of 8.7, this is classified as a high-severity issue that requires immediate attention to prevent unauthorized access and potential data exfiltration.

Immediate Action: Upgrade Statamic CMS to version 6.2.3 or later to apply the necessary security patches.

Proactive Monitoring: Review administrative access logs for unusual activity or the creation of unauthorized accounts. Monitor the control panel for suspicious script injections within content titles.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts. Utilize a Web Application Firewall (WAF) to detect and block common XSS patterns in incoming requests.

Public Exploit Available: No (exploit_available unknown)

Given the potential for privilege escalation and the high CVSS severity rating, organizations utilizing Statamic CMS must prioritize updating to version 6.2.3 immediately. Failure to patch allows authenticated users to bypass standard security controls, creating a substantial risk to the entire content management infrastructure.