← Zuruck zu CVEs

CVE-2020-11083

LOW

3.5

Beschreibung

In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.

CVE Details

CVSS v3.1 Bewertung3.5

SchweregradLOW

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienHIGH

BenutzerinteraktionREQUIRED

Veroffentlicht7/14/2020

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

octobercms:october

Schwachen (CWE)

CWE-79CWE-79

Referenzen

http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html(security-advisories@github.com)

http://seclists.org/fulldisclosure/2020/Aug/2(security-advisories@github.com)

https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746(security-advisories@github.com)

https://github.com/octobercms/october/security/advisories/GHSA-w4pj-7p68-3vgv(security-advisories@github.com)

https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94(security-advisories@github.com)

http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2020/Aug/2(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/octobercms/october/security/advisories/GHSA-w4pj-7p68-3vgv(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.