PT-2020-14314 · October · October Cms

Hoan Hoang · Published 2020-11-23 · Updated 2020-11-30 · CVE-2020-15249

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions October CMS versions 1.0.319 through 1.0.468

Description The issue allows backend users with access to upload files to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under the website's domain, but they would have to convince their target to visit that location directly in the target's browser. The backend does not display SVGs inline anywhere, and SVGs are only displayed as image resources in the backend and are thus unable to be executed.

Recommendations For versions 1.0.319 through 1.0.468, update to Build 469 (v1.0.469) or v1.1.0 to resolve the issue. As a temporary workaround, consider applying the patch from https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469 or v1.1.0. Restrict access to uploading SVG files until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-15249

GHSA-FX3V-553X-3C4Q

Affected Products

October Cms

References · 7

• https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15249 · Security Note
• https://osv.dev/vulnerability/GHSA-fx3v-553x-3c4q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15249 · Vendor Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-fx3v-553x-3c4q · Note
• https://t.me/cvenotify/6061 · Telegram Post
• https://t.me/cibsecurity/16734 · Telegram Post