PT-2017-13966 · October · October Cms

Ishaq Mohammed · Publicado 2017-10-12 · Atualizado 2022-05-13 · CVE-2017-15284

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OctoberCMS version 1.0.425

Description The issue allows a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.

Recommendations For OctoberCMS version 1.0.425, consider restricting the upload of SVG files or disabling the ability to set custom Avatars until a fix is available. Additionally, restrict access to the profile management feature to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-15284

GHSA-GVGF-FP4M-2HW6

Produtos afetados

October Cms

Referências · 7

• 🔥 https://packetstormsecurity.com/files/144587/OctoberCMS-1.0.425-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/42978 · Exploit
• https://github.com/octobercms/october · Nota
• https://github.com/octobercms/library/commit/3bbbbf3da469f457881b5af902eb0b89b95189a2 · Correção
• https://osv.dev/vulnerability/CVE-2017-15284 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15284 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-gvgf-fp4m-2hw6 · Aviso do Fabricante