CVE-2023-44383

Published: Nov 29, 2023Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.

Affected (1)

Products: Octobercms: October

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Octobercms October	From 3.0.0 to 3.5.2

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://github.com/octobercms/october/commit/b7eed0bbf54d07ff310fcdc7037a8e8bf1f5043b

Source: security-advisories@github.com

Patch

https://github.com/octobercms/october/security/advisories/GHSA-rvx8-p3xp-fj3p

Source: security-advisories@github.com

MitigationVendor Advisory

https://github.com/octobercms/october/commit/b7eed0bbf54d07ff310fcdc7037a8e8bf1f5043b

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/octobercms/october/security/advisories/GHSA-rvx8-p3xp-fj3p

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

Timeline

No history available yet.