Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNwYzItZm03cC1xMnZn

Cross-site Scripting in October

Impact

Pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack.

Patches

Issue has been patched in Build 467 (v1.0.467).

Workarounds

Apply https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 to your installation manually if unable to upgrade to Build 467.

References

• https://research.securitum.com/the-curious-case-of-copy-paste/

For more information

If you have any questions or comments about this advisory:

• Email us at [email protected]

Threat Assessment

Assessed as Low given that by the nature of the attack it can only impact users that do it to themselves by copying and pasting from malicious websites.

Acknowledgements

Thanks to Michał Bentkowski of Securitum for finding the original issue in Froala and @tomaszstrojny for reporting the issue to the October CMS team.

Permalink: https://github.com/advisories/GHSA-3pc2-fm7p-q2vg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNwYzItZm03cC1xMnZn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

CVSS Score: 3.7
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS Percentage: 0.00086
EPSS Percentile: 0.38516

Identifiers: GHSA-3pc2-fm7p-q2vg, CVE-2020-4061
References:

• https://github.com/octobercms/october/security/advisories/GHSA-3pc2-fm7p-q2vg
• https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5
• https://research.securitum.com/the-curious-case-of-copy-paste/
• https://nvd.nist.gov/vuln/detail/CVE-2020-4061
• https://github.com/advisories/GHSA-3pc2-fm7p-q2vg

Repository: https://github.com/octobercms/october
Blast Radius: 9.3

Affected Packages