PT-2020-17856 · October · October Cms

Published 2020-07-02 · Updated 2020-07-06 · CVE-2020-4061

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October CMS versions 1.0.319 through 1.0.466

Description Pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This issue is assessed as Low, given that it can only impact users who copy and paste from malicious websites. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions 1.0.319 through 1.0.466, update to version 1.0.467 to resolve the issue. As a temporary workaround for versions that cannot be updated to 1.0.467, apply the patch from https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 to your installation manually.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-4061

GHSA-3PC2-FM7P-Q2VG

Affected Products

October Cms

References · 7

• 🔥 https://research.securitum.com/the-curious-case-of-copy-paste · Exploit
• https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 · Patch
• https://osv.dev/vulnerability/CVE-2020-4061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4061 · Security Note
• https://osv.dev/vulnerability/GHSA-3pc2-fm7p-q2vg · Vendor Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-3pc2-fm7p-q2vg · Note
• https://t.me/cvenotify/4829 · Telegram Post