PT-2023-26079 · Unknown · October Cms

Okan Kurtuluş · Publicado 2023-07-26 · Atualizado 2023-08-02 · CVE-2023-37692

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October CMS version 3.4.4

Description The issue allows attackers to execute arbitrary code via a crafted file, specifically an svg file, which can be uploaded to the system. This can be done in the context of a browser and requires the attacker to be authenticated as a user.

Recommendations For October CMS version 3.4.4, consider disabling the file upload feature, especially for svg files, until a patch is available to prevent arbitrary code execution. Restrict access to the file upload module to minimize the risk of exploitation. Avoid using the file upload functionality with untrusted files or sources until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-37692

GHSA-R47V-RXCG-P28J

Produtos afetados

October Cms

Referências · 5

• 🔥 https://okankurtulus.com.tr/2023/07/24/october-cms-v3-4-4-stored-cross-site-scripting-xss-authenticated · Exploit
• https://github.com/octobercms/october · Nota
• https://osv.dev/vulnerability/GHSA-r47v-rxcg-p28j · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-37692 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37692 · Aviso do Fabricante