Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2023-44383

October CMS stored XSS by authenticated backend user with improper configuration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

octobercms october

  • >= 3.0.0, 3.5.2affected

References