CVE-2017-15284: XSS
Published Oct 12, 2017
·Updated
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.
Affected Software
2 affected componentsFixes available
October CMS Debugbar=1.0.425
composer/october/rain<1.0.426
1.0.426
Remediation
Event History
Oct 12, 2017
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
May 13, 2022
Advisory Published
via GitHub·01:24 AM
Data Sourced
via GitHub·01:24 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-15284?
CVE-2017-15284 is considered a medium-severity vulnerability due to its potential for Cross-Site Scripting attacks.
2
How do I fix CVE-2017-15284?
To fix CVE-2017-15284, users should upgrade to a patched version of OctoberCMS that addresses this vulnerability.
3
Who is affected by CVE-2017-15284?
CVE-2017-15284 affects any installation of OctoberCMS version 1.0.425.
4
What type of vulnerability is CVE-2017-15284?
CVE-2017-15284 is a Cross-Site Scripting (XSS) vulnerability.
5
Can CVE-2017-15284 be exploited easily?
Yes, CVE-2017-15284 can be exploited relatively easily if a low-privileged user uploads a malicious SVG file.