PT-2018-15193 · October · October Cms

Published 2018-07-23 · Updated 2020-08-03 · CVE-2018-1999008

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October CMS version prior to build 437

Description The issue is related to a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality. This can be exploited by an authenticated user with media module permission, allowing them to create arbitrary folder names with XSS content.

Recommendations For October CMS version prior to build 437, update to build 437 or later to resolve the issue. As a temporary workaround, consider restricting media module permissions to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1999008

Affected Products

October Cms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-1999008 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1999008 · Vendor Advisory
• https://octobercms.com/support/article/rn-10 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1999008 · Note