UpHeron
All vulnerabilities

Servers and applications

CVE-2018-1999008

October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS).…

Severity
Medium 5.4
Published
23 Jul 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.437
Exploit chance
0.5% in the next 30 daysHigher than 44% of CVEs. EPSS by FIRST, 10 Nov 2026
Weakness
Cross-site scripting (CWE-79)
Attack
Over the network · Needs a user account · Needs someone to click or open something
Attacker can
Read some data · Change some data
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Sources
NVD

Description

October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS). This vulnerability appears to have been fixed in build 437.

From NVD.

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • Every version before 1.0.437

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-1999008
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-1999008