Vulnerability · Published Jul 14, 2020 · Assigned by GitHub_M

CVE-2020-11083Stored XSS in October

Low 3.5

In plain English

A low-severity cross-site scripting in October from October CMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)1.1%top 33.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	october/backend	1.0.466	GHSA-w4pj-7p68-3vgv

Affected products (as reported)

Vendor	Product	Versions
October CMS	October	>= 1.0.319, < 1.0.466

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/octobercms/october/security/advisories/GHSA-w4pj-7p68-3vgv x_refsource_CONFIRM
https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746 x_refsource_MISC
https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94 x_refsource_MISC
http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html x_refsource_MISC
20200804 October CMS <= Build 465 Multiple Vulnerabilities - Arbitrary File Read mailing-list, x_refsource_FULLDISC