CVE-2020-4061

Katalog CVE

CVSS 5.4 · Medium EPSS 0,82%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada octobercms october. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467.

Rincian

Terbit di NVD

2 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 56,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 patch · advisory pihak ketiga
• https://github.com/octobercms/october/security/advisories/GHSA-3pc2-fm7p-q2vg advisory pihak ketiga
• https://research.securitum.com/the-curious-case-of-copy-paste/ exploit · advisory pihak ketiga