October CMS Cross-site Scripting vulnerability · CVE-2023-25365 · GitHub Advisory Database · GitHub

October CMS Cross-site Scripting vulnerability

High severity GitHub Reviewed Published Feb 9, 2024 to the GitHub Advisory Database • Updated Feb 16, 2024

Package

october/october (Composer)

Affected versions

<= 3.2.0

Patched versions

None

Description

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3

References

Published by the National Vulnerability Database

Feb 8, 2024

Published to the GitHub Advisory Database Feb 9, 2024

Last updated Feb 16, 2024

Reviewed Feb 16, 2024

Severity

High

7.8

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H