CVE-2023-44383: octobercms october

csirt@kutim:~/threat-intel/cve/CVE-2023-44383

CVSS 5.4 · Medium EPSS 0,41%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada octobercms october. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.

Rincian

Terbit di NVD: 29 November 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,41% peluang dieksploitasi; lebih tinggi dari 33,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
octobercms	october	Versi 3.0.0 hingga sebelum 3.5.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/octobercms/october/security/advisories/GHSA-rvx8-p3xp-fj3p mitigasi · advisory vendor
https://github.com/octobercms/october/commit/b7eed0bbf54d07ff310fcdc7037a8e8bf1f5043b patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.