PT-2018-17944 · Rainlab+1 · Rainlab Blog Plugin+1

Samrat Das · Publicado 2018-02-18 · Atualizado 2022-05-13 · CVE-2018-7198

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October CMS versions through 1.0.431 The RainLab Blog Plugin used in October CMS versions through 1.0.431

Description The issue allows for XSS by entering HTML on the Add Posts page. This can be exploited through the RainLab Blog Plugin.

Recommendations For October CMS versions through 1.0.431, update to a version that includes a fix for this issue. For The RainLab Blog Plugin used in October CMS versions through 1.0.431, consider disabling the plugin until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-7198

GHSA-96MH-7XPR-QCGW

Produtos afetados

October Cms

Rainlab Blog Plugin

Referências · 7

• 🔥 https://exploit-db.com/exploits/44144 · Exploit
• https://github.com/rainlab/blog-plugin · Nota
• https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7198 · Nota de Segurança
• http://securitywarrior9.blogspot.com/2018/02/html-injection-october-cms.html · Nota
• https://osv.dev/vulnerability/CVE-2018-7198 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-96mh-7xpr-qcgw · Aviso do Fabricante