PT-2020-12540 · Rainlab+1 · Rainlab.Blog+1

Sivanesh Ashok + 1 · Published 2020-07-14 · Updated 2023-01-28 · CVE-2020-11083

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions October CMS versions 1.0.319 through 1.0.465 RainLab.Blog plugin versions prior to 1.4.1

Description A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This issue has been fixed by restricting the ability to store JS in markdown to only users that have been explicitly granted the backend.allow unsafe markdown permission.

Recommendations For October CMS versions 1.0.319 through 1.0.465, update to version 1.0.466 or later. For RainLab.Blog plugin versions prior to 1.4.1, update to version 1.4.1 or later. As a temporary workaround, consider applying the manual patches to your installation if unable to upgrade to the fixed versions.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-11083

GHSA-W4PJ-7P68-3VGV

Affected Products

October Cms

Rainlab.Blog

References · 8

• 🔥 http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Aug/2 · Exploit
• https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746 · Patch
• https://github.com/octobercms/october/security/advisories/GHSA-w4pj-7p68-3vgv · Patch
• https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11083 · Security Note
• https://osv.dev/vulnerability/GHSA-w4pj-7p68-3vgv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11083 · Vendor Advisory