Lucene search
Veracode Vulnerability DatabaseVERACODE:25609HistoryJun 04, 2020 - 8:12 a.m.
Cross-Site Scripting (XSS)
2020-06-0408:12:55
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
0.003 Low
EPSS
Percentile
71.5%
OctoberCMS is vulnerable to cross-site scripting (XSS). The attack is possible because it does not prevent uploading of malicious CSV file by sanitizing the imported CSV column names column parameters.
| CPE | Name | Operator | Version |
|---|---|---|---|
| october/october | le | 1.0.465 | |
| october/october | le | 1.0.465 |
References
packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html
seclists.org/fulldisclosure/2020/Aug/2
github.com/advisories/GHSA-gg6x-xx78-448c
github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c
github.com/octobercms/october/security/advisories/GHSA-gg6x-xx78-448c
stazot.com
Related
cve
cve
CVE-2020-5298
2020-06-03 22:15:11
nvd
nvd
CVE-2020-5298
2020-06-03 22:15:11
osv
osv
Reflected XSS when importing CSV in OctoberCMS
2020-06-03 21:58:32
CVE-2020-5298
2020-06-03 22:15:11
cvelist
cvelist
CVE-2020-5298 Reflected XSS when importing CSV in OctoberCMS
2020-06-03 21:55:12
prion
prion
Design/Logic Flaw
2020-06-03 22:15:00
github
github
Reflected XSS when importing CSV in OctoberCMS
2020-06-03 21:58:32
zdt
zdt
packetstorm
packetstorm
October CMS Build 465 XSS / File Read / File Deletion / CSV Injection
2020-08-03 00:00:00