PT-2017-10890 · October · October Cms

Publicado 2017-11-17 · Atualizado 2022-05-13 · CVE-2017-1000193

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October CMS build 412

Description The issue allows for stored XSS in the brand logo image name, resulting in JavaScript code execution in the victim's browser. This occurs because the brand logo image name is not properly sanitized, enabling an attacker to inject malicious JavaScript code.

Recommendations For October CMS build 412, update the build to a version that includes a fix for this issue, or as a temporary workaround, consider validating and sanitizing all user-inputted data for the brand logo image name to prevent JavaScript code execution.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-1000193

GHSA-3P6C-9XHM-8X7H

Produtos afetados

October Cms

Referências · 5

• https://github.com/octobercms/october · Nota
• https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-66d6dfe5e11488e1afefcb69b8bdaabfR31 · Correção
• https://osv.dev/vulnerability/GHSA-3p6c-9xhm-8x7h · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000193 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1000193 · Aviso do Fabricante