PT-2017-10890 · October · October Cms

Published 2017-11-17 · Updated 2022-05-13 · CVE-2017-1000193

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October CMS build 412

Description The issue allows for stored XSS in the brand logo image name, resulting in JavaScript code execution in the victim's browser. This occurs because the brand logo image name is not properly sanitized, enabling an attacker to inject malicious JavaScript code.

Recommendations For October CMS build 412, update the build to a version that includes a fix for this issue, or as a temporary workaround, consider validating and sanitizing all user-inputted data for the brand logo image name to prevent JavaScript code execution.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-1000193

GHSA-3P6C-9XHM-8X7H

Affected Products

October Cms

References · 5

• https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-66d6dfe5e11488e1afefcb69b8bdaabfR31 · Patch
• https://osv.dev/vulnerability/GHSA-3p6c-9xhm-8x7h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000193 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1000193 · Vendor Advisory
• https://github.com/octobercms/october · Note