CVE-2020-11083lowCWE-79

CVE-2020-11083: low-severity vulnerability in October

Stored XSS in October

Published · Updated

Follow this CVE+ Monitor October CMS+ Monitor october/backend

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.5epss 1.1%
In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Affected products
October CMS · October
Related CVEs — October

In the same product, most dangerous first.

CVE-2020-4061LOWCross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websitesEPSS 0.8%