PT-2018-15193 · October · October Cms

Publicado 2018-07-23 · Atualizado 2020-08-03 · CVE-2018-1999008

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October CMS version prior to build 437

Description The issue is related to a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality. This can be exploited by an authenticated user with media module permission, allowing them to create arbitrary folder names with XSS content.

Recommendations For October CMS version prior to build 437, update to build 437 or later to resolve the issue. As a temporary workaround, consider restricting media module permissions to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-1999008

Produtos afetados

October Cms

Referências · 4

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1999008 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999008 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1999008 · Aviso do Fabricante
• https://octobercms.com/support/article/rn-10 · Aviso do Fabricante