CVE-2020-5298: Improper Neutralization of Alternate XSS Syntax
(updated )
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the ImportExportController behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).
References
- packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html
- seclists.org/fulldisclosure/2020/Aug/2
- github.com/advisories/GHSA-gg6x-xx78-448c
- github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c
- github.com/octobercms/october/security/advisories/GHSA-gg6x-xx78-448c
- nvd.nist.gov/vuln/detail/CVE-2020-5298
Code Behaviors & Features
Detect and mitigate CVE-2020-5298 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →