PT-2023-29218 · October · October

Aldin Visnjic + 3 · Publicado 2023-11-29 · Atualizado 2023-12-05 · CVE-2023-44383

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October versions prior to 3.5.2

Description A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. The issue arises because SVG files are supported by default, which has led to mistaken vulnerability reports.

Recommendations For versions prior to 3.5.2, consider removing the svg extension from the list of supported file types as a temporary workaround until the patch can be applied. Update to version 3.5.2, which includes an SVG sanitizer enabled by default for new installations. For existing sites, enable the SVG sanitizer in the config/media.php file by setting 'clean vectors' => true,.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-44383

GHSA-RVX8-P3XP-FJ3P

Produtos afetados

October

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44383.json · Exploit
• https://github.com/octobercms/october · Nota
• https://github.com/octobercms/october/commit/b7eed0bbf54d07ff310fcdc7037a8e8bf1f5043b · Correção
• https://github.com/octobercms/october/security/advisories/GHSA-rvx8-p3xp-fj3p · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-44383 · Aviso do Fabricante
• https://t.me/cvenotify/61527 · Publicação no Telegram
• https://t.me/cvenotify/62369 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-rvx8-p3xp-fj3p · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-44383 · Nota de Segurança