Cross-site scripting in October CMS - CVE-2017-15284
Published: October 12, 2017 / Updated: August 9, 2020
Vulnerability identifier: #VU38072
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Clear
CVE-ID: CVE-2017-15284
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: OctoberCMS
Affected software:
October CMS
October CMS
Detailed vulnerability description
The vulnerability allows a remote authenticated user to read and manipulate data.
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.
How to mitigate CVE-2017-15284
Install update from vendor's website.