CVE-2023-44383 — Cross-site Scripting in October

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.9%
top 23.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Octobercms OctoberOctober System
Timeline
PublishedNov 29

Description

October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶Packagistoctober/system3.0.0 — 3.5.2
▶NVDoctobercms/october3.0.0 — 3.5.2
▶CVEListV5octobercms/october>= 3.0.0, 3.5.2

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
October CMS stored XSS by authenticated backend user with improper configuration↗2023-11-29
▶
OSV
October CMS stored XSS by authenticated backend user with improper configuration↗2023-11-29
▶