CVE-2020-5298

2020-06-0322:15:11

Google

osv.dev

6.1 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.5%

JSON

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the ImportExportController behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).

CPENameOperatorVersion
octobereq1.0.379
octobereq1.0.389
octobereq1.0.419
octobereq1.0.320
octobereq1.0.341
octobereq1.0.452
octobereq1.0.400
octobereq1.0.326
octobereq1.0.350
octobereq1.0.365

Name	Operator	Version
october	eq	1.0.379
october	eq	1.0.389
october	eq	1.0.419
october	eq	1.0.320
october	eq	1.0.341
october	eq	1.0.452
october	eq	1.0.400
october	eq	1.0.326
october	eq	1.0.350
october	eq	1.0.365