CVE-2020-11083: Stored XSS in October
In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-11083?
CVE-2020-11083 is a vulnerability in October CMS that allows a user with access to a markdown FormWidget to create a stored XSS attack.
How does CVE-2020-11083 affect users?
CVE-2020-11083 affects users of October CMS versions 1.0.319 to 1.0.466 who have access to the markdown FormWidget and its generated HTML.
How severe is CVE-2020-11083?
CVE-2020-11083 has a severity rating of 4.8 (medium).
How can I fix CVE-2020-11083?
To fix CVE-2020-11083, update October CMS to version 1.0.466 or later.
What is the CWE ID for CVE-2020-11083?
The CWE ID for CVE-2020-11083 is 79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').