What is CVE-2018-1999008?

CVE-2018-1999008 is a medium-severity vulnerability in Octobercms October, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2018-07-23.

How severe is CVE-2018-1999008?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Octobercms October

CVE-2018-1999008

October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS). This vulnerability appears to have been fixed in build 437.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.005 (41.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Octobercms October
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2018-1999008?: CVE-2018-1999008 is a medium-severity vulnerability in Octobercms October, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2018-07-23.
How severe is CVE-2018-1999008?: Medium severity. CVSS v3 base score is 5.4 out of 10.