CVE-2018-1999008 Cross-site scripting in n/a
Authenticated users with media permissions can inject malicious scripts via folder names in October CMS, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-1999008?
CVE-2018-1999008 is a medium-severity cross-site scripting vulnerability in Octobercms October, published on 23 Jul 2018. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS). This vulnerability appears to have been fixed in build 437.
Weakness: CWE-79
Which versions are affected by CVE-2018-1999008?
It affects 1 product.
Products include Octobercms October.
How do I fix CVE-2018-1999008?
No fix has been published for CVE-2018-1999008 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-1999008 being exploited?
There is no known exploitation of CVE-2018-1999008 in the wild and no public exploit code.
Other vulnerabilities in Octobercms October
Sources
Also known as GHSA-c9g2-5qmq-gwc7.