Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2017-1000193

October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser.

VectorNETWORK

PublishedNov 17, 2017, 02:29

Published Bycve@mitre.org

Base Score

Score6.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

october/october(Packagist)01.0.413N/A

References

https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-66d6dfe5e11488e1afefcb69b8bdaabfR31

Weakness Type

CWE-79

CVSS Metrics

Base Score

6.1

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.0

Attack Vector (AV)

NETWORK