CVE-2020-5298 Reflected XSS when importing CSV in OctoberCMS
Attackers can execute arbitrary scripts in victim browsers via malicious CSV imports in OctoberCMS, requiring user interaction.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5298?
CVE-2020-5298 is a medium-severity cross-site scripting vulnerability in Octobercms October, published on 3 Jun 2020. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).
Which versions are affected by CVE-2020-5298?
2 open source packages ship an affected version, including october/backend. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
october/backend Packagist | From 1.0.319 | 1.0.466 |
october/backend Packagist | From 1.0.319 | 1.0.466 |
Products include Octobercms October.
How do I fix CVE-2020-5298?
Upgrade october/backend to 1.0.466 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-5298 being exploited?
There is no known exploitation of CVE-2020-5298 in the wild and no public exploit code.
Other vulnerabilities in Octobercms October
Sources
Also known as GHSA-gg6x-xx78-448c.