CVE-2020-11083

2020-07-1421:15:10

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.4%

JSON

In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.

CPENameOperatorVersion
octobereq1.0.370
octobereq1.0.418
octobereq1.0.454
octobereq1.0.428
octobereq1.0.457
octobereq1.0.327
octobereq1.0.460
octobereq1.0.425
octobereq1.0.411
octobereq1.0.429

Name	Operator	Version
october	eq	1.0.370
october	eq	1.0.418
october	eq	1.0.454
october	eq	1.0.428
october	eq	1.0.457
october	eq	1.0.327
october	eq	1.0.460
october	eq	1.0.425
october	eq	1.0.411
october	eq	1.0.429