CVE-2023-44383: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

November 29, 2023

October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.

References

github.com/advisories/GHSA-rvx8-p3xp-fj3p
github.com/octobercms/october/commit/b7eed0bbf54d07ff310fcdc7037a8e8bf1f5043b
github.com/octobercms/october/security/advisories/GHSA-rvx8-p3xp-fj3p
nvd.nist.gov/vuln/detail/CVE-2023-44383

Code Behaviors & Features

Detect and mitigate CVE-2023-44383 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →