Vulnerabilities > CVE-2020-5298 - Improper Neutralization of Alternate XSS Syntax vulnerability in Octobercms October

CVSS 3.5 - LOW

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

SINGLE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

octobercms

CWE-87

NVD

Published: 2020-06-03

Updated: 2022-06-30

Summary

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).

Vulnerable Configurations

Part	Description	Count
Application	Octobercms Octobercms October 1.0.319 Octobercms October 1.0.320 Octobercms October 1.0.321 Octobercms October 1.0.322 Octobercms October 1.0.323 Octobercms October 1.0.324 Octobercms October 1.0.325 Octobercms October 1.0.326 Octobercms October 1.0.327 Octobercms October 1.0.328 Octobercms October 1.0.329 Octobercms October 1.0.330 Octobercms October 1.0.331 Octobercms October 1.0.332 Octobercms October 1.0.333 Octobercms October 1.0.334 Octobercms October 1.0.335 Octobercms October 1.0.336 Octobercms October 1.0.337 Octobercms October 1.0.338 Octobercms October 1.0.339 Octobercms October 1.0.340 Octobercms October 1.0.341 Octobercms October 1.0.342 Octobercms October 1.0.343 Octobercms October 1.0.344 Octobercms October 1.0.345 Octobercms October 1.0.346 Octobercms October 1.0.347 Octobercms October 1.0.348 Octobercms October 1.0.349 Octobercms October 1.0.350 Octobercms October 1.0.351 Octobercms October 1.0.352 Octobercms October 1.0.353 Octobercms October 1.0.354 Octobercms October 1.0.355 Octobercms October 1.0.356 Octobercms October 1.0.357 Octobercms October 1.0.358 Octobercms October 1.0.359 Octobercms October 1.0.360 Octobercms October 1.0.361 Octobercms October 1.0.362 Octobercms October 1.0.363 Octobercms October 1.0.364 Octobercms October 1.0.365 Octobercms October 1.0.366 Octobercms October 1.0.367 Octobercms October 1.0.368 Octobercms October 1.0.369 Octobercms October 1.0.370 Octobercms October 1.0.371 Octobercms October 1.0.372 Octobercms October 1.0.373 Octobercms October 1.0.374 Octobercms October 1.0.375 Octobercms October 1.0.376 Octobercms October 1.0.377 Octobercms October 1.0.378 Octobercms October 1.0.379 Octobercms October 1.0.380 Octobercms October 1.0.381 Octobercms October 1.0.382 Octobercms October 1.0.383 Octobercms October 1.0.384 Octobercms October 1.0.385 Octobercms October 1.0.386 Octobercms October 1.0.387 Octobercms October 1.0.388 Octobercms October 1.0.389 Octobercms October 1.0.390 Octobercms October 1.0.391 Octobercms October 1.0.392 Octobercms October 1.0.393 Octobercms October 1.0.394 Octobercms October 1.0.395 Octobercms October 1.0.396 Octobercms October 1.0.397 Octobercms October 1.0.398 Octobercms October 1.0.399 Octobercms October 1.0.400 Octobercms October 1.0.401 Octobercms October 1.0.402 Octobercms October 1.0.403 Octobercms October 1.0.404 Octobercms October 1.0.405 Octobercms October 1.0.406 Octobercms October 1.0.407 Octobercms October 1.0.408 Octobercms October 1.0.409 Octobercms October 1.0.410 Octobercms October 1.0.411 Octobercms October 1.0.412 Octobercms October 1.0.413 Octobercms October 1.0.414 Octobercms October 1.0.415 Octobercms October 1.0.416 Octobercms October 1.0.417 Octobercms October 1.0.418 Octobercms October 1.0.419 Octobercms October 1.0.420 Octobercms October 1.0.421 Octobercms October 1.0.422 Octobercms October 1.0.423 Octobercms October 1.0.424 Octobercms October 1.0.425 Octobercms October 1.0.426 Octobercms October 1.0.427 Octobercms October 1.0.428 Octobercms October 1.0.429 Octobercms October 1.0.430 Octobercms October 1.0.431 Octobercms October 1.0.432 Octobercms October 1.0.433 Octobercms October 1.0.434 Octobercms October 1.0.435 Octobercms October 1.0.436 Octobercms October 1.0.437 Octobercms October 1.0.438 Octobercms October 1.0.439 Octobercms October 1.0.440 Octobercms October 1.0.441 Octobercms October 1.0.442 Octobercms October 1.0.443 Octobercms October 1.0.444 Octobercms October 1.0.445 Octobercms October 1.0.446 Octobercms October 1.0.447 Octobercms October 1.0.448 Octobercms October 1.0.449 Octobercms October 1.0.450 Octobercms October 1.0.451 Octobercms October 1.0.452 Octobercms October 1.0.453 Octobercms October 1.0.454 Octobercms October 1.0.455 Octobercms October 1.0.456 Octobercms October 1.0.457 Octobercms October 1.0.458 Octobercms October 1.0.459 Octobercms October 1.0.460 Octobercms October 1.0.461 Octobercms October 1.0.462 Octobercms October 1.0.463 Octobercms October 1.0.464 Octobercms October 1.0.465	147

Common Weakness Enumeration (CWE)

CWE-87 - Improper Neutralization of Alternate XSS Syntax

Common Attack Pattern Enumeration and Classification (CAPEC)

Cross-Site Scripting Using Alternate Syntax
The attacker uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References