GitHub Advisoryadvisory · Packagist

GHSA-gcgj-qh8p-57hm October CMS Cross-site Scripting vulnerability

HIGH Published 2024-02-09 Modified 2024-02-16 Official page ↗
Aliases
CVE-2023-25365
Ecosystem
Packagist
Packages
october/october
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-434, CWE-79
Reviewed
2024-02-16

Affected packages

• Packagist october/october: <= 3.2.0 (no fix yet)

Description

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3

Related

Alias · CVE (1)

  • CVE-2023-25365 Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3 vulnerability

Weakness · CWE (2)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References