GHSA-r47v-rxcg-p28j

Stored Cross-Site Scripting October CMS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-37692

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	october/october	<= 3.4.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An svg file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code in the context of a browser via a crafted svg file. Attackers must be authenticated as users.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-37692 advisory
https://github.com/octobercms/october package
https://okankurtulus.com.tr/2023/07/24/october-cms-v3-4-4-stored-cross-site-scripting-xss-authenticated web