PT-2023-26079 · Unknown · October Cms

Okan Kurtuluş · Published 2023-07-26 · Updated 2023-08-02 · CVE-2023-37692

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October CMS version 3.4.4

Description The issue allows attackers to execute arbitrary code via a crafted file, specifically an svg file, which can be uploaded to the system. This can be done in the context of a browser and requires the attacker to be authenticated as a user.

Recommendations For October CMS version 3.4.4, consider disabling the file upload feature, especially for svg files, until a patch is available to prevent arbitrary code execution. Restrict access to the file upload module to minimize the risk of exploitation. Avoid using the file upload functionality with untrusted files or sources until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-37692

GHSA-R47V-RXCG-P28J

Affected Products

October Cms

References · 5

• 🔥 https://okankurtulus.com.tr/2023/07/24/october-cms-v3-4-4-stored-cross-site-scripting-xss-authenticated · Exploit
• https://osv.dev/vulnerability/GHSA-r47v-rxcg-p28j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37692 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37692 · Vendor Advisory
• https://github.com/octobercms/october · Note