OctoberCMS Cross-Site Scripting
The advisory, in context
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 1.0.426
Fixed in 1.0.426
107 explicitly affected versions
v1.0.319, v1.0.320, v1.0.321, v1.0.322, v1.0.323, v1.0.324, v1.0.325, v1.0.326, v1.0.327, v1.0.328, v1.0.329, v1.0.330, v1.0.331, v1.0.332, v1.0.333, v1.0.334, v1.0.335, v1.0.336, v1.0.337, v1.0.338, v1.0.339, v1.0.340, v1.0.341, v1.0.342, v1.0.343, v1.0.344, v1.0.345, v1.0.346, v1.0.347, v1.0.348, v1.0.349, v1.0.350, v1.0.351, v1.0.352, v1.0.353, v1.0.354, v1.0.355, v1.0.356, v1.0.357, v1.0.358, v1.0.359, v1.0.360, v1.0.361, v1.0.362, v1.0.363, v1.0.364, v1.0.365, v1.0.366, v1.0.367, v1.0.368, v1.0.369, v1.0.370, v1.0.371, v1.0.372, v1.0.373, v1.0.374, v1.0.375, v1.0.376, v1.0.377, v1.0.378, v1.0.379, v1.0.380, v1.0.381, v1.0.382, v1.0.383, v1.0.384, v1.0.385, v1.0.386, v1.0.387, v1.0.388, v1.0.389, v1.0.390, v1.0.391, v1.0.392, v1.0.393, v1.0.394, v1.0.395, v1.0.396, v1.0.397, v1.0.398, v1.0.399, v1.0.400, v1.0.401, v1.0.402, v1.0.403, v1.0.404, v1.0.405, v1.0.406, v1.0.407, v1.0.408, v1.0.409, v1.0.410, v1.0.411, v1.0.412, v1.0.413, v1.0.414, v1.0.415, v1.0.416, v1.0.417, v1.0.418, v1.0.419, v1.0.420, v1.0.421, v1.0.422, v1.0.423, v1.0.424, v1.0.425
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.426"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v1.0.319",
"v1.0.320",
"v1.0.321",
"v1.0.322",
"v1.0.323",
"v1.0.324",
"v1.0.325",
"v1.0.326",
"v1.0.327",
"v1.0.328",
"v1.0.329",
"v1.0.330",
"v1.0.331",
"v1.0.332",
"v1.0.333",
"v1.0.334",
"v1.0.335",
"v1.0.336",
"v1.0.337",
"v1.0.338",
"v1.0.339",
"v1.0.340",
"v1.0.341",
"v1.0.342",
"v1.0.343",
"v1.0.344",
"v1.0.345",
"v1.0.346",
"v1.0.347",
"v1.0.348",
"v1.0.349",
"v1.0.350",
"v1.0.351",
"v1.0.352",
"v1.0.353",
"v1.0.354",
"v1.0.355",
"v1.0.356",
"v1.0.357",
"v1.0.358",
"v1.0.359",
"v1.0.360",
"v1.0.361",
"v1.0.362",
"v1.0.363",
"v1.0.364",
"v1.0.365",
"v1.0.366",
"v1.0.367",
"v1.0.368",
"v1.0.369",
"v1.0.370",
"v1.0.371",
"v1.0.372",
"v1.0.373",
"v1.0.374",
"v1.0.375",
"v1.0.376",
"v1.0.377",
"v1.0.378",
"v1.0.379",
"v1.0.380",
"v1.0.381",
"v1.0.382",
"v1.0.383",
"v1.0.384",
"v1.0.385",
"v1.0.386",
"v1.0.387",
"v1.0.388",
"v1.0.389",
"v1.0.390",
"v1.0.391",
"v1.0.392",
"v1.0.393",
"v1.0.394",
"v1.0.395",
"v1.0.396",
"v1.0.397",
"v1.0.398",
"v1.0.399",
"v1.0.400",
"v1.0.401",
"v1.0.402",
"v1.0.403",
"v1.0.404",
"v1.0.405",
"v1.0.406",
"v1.0.407",
"v1.0.408",
"v1.0.409",
"v1.0.410",
"v1.0.411",
"v1.0.412",
"v1.0.413",
"v1.0.414",
"v1.0.415",
"v1.0.416",
"v1.0.417",
"v1.0.418",
"v1.0.419",
"v1.0.420",
"v1.0.421",
"v1.0.422",
"v1.0.423",
"v1.0.424",
"v1.0.425"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2017-15284
- https://github.com/octobercms/library/commit/3bbbbf3da469f457881b5af902eb0b89b95189a2
- https://github.com/octobercms/october
- https://packetstormsecurity.com/files/144587/OctoberCMS-1.0.425-Cross-Site-Scripting.html
- https://www.exploit-db.com/exploits/42978