CVE-2020-15249 — Cross-site Scripting in October

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.2%
top 62.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Octobercms OctoberOctober Backend
Timeline
PublishedNov 23

Description

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under the website's domain (i.e. /storage/app/media/evil.svg…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶Packagistoctober/backend1.0.319 — 1.0.469
▶NVDoctobercms/october1.0.319 — 1.0.469
▶CVEListV5octobercms/october>= 1.0.319, < 1.0.469

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
Stored XSS by authenticated backend user with access to upload files↗2020-11-23
▶
GHSA
Stored XSS by authenticated backend user with access to upload files↗2020-11-23
▶