What is GHSA-3pc2-fm7p-q2vg?

GHSA-3pc2-fm7p-q2vg is a security advisory published by GitHub Security Advisories with Low severity. Cross-site Scripting in October

Which CVE IDs does GHSA-3pc2-fm7p-q2vg cover?

GHSA-3pc2-fm7p-q2vg covers the following CVE IDs: CVE-2020-4061. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3pc2-fm7p-q2vg?

GHSA-3pc2-fm7p-q2vg has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

Which products are affected by GHSA-3pc2-fm7p-q2vg?

GHSA-3pc2-fm7p-q2vg affects 1 product, including: composer/october/backend:\u003e= 1.0.319, \u003c 1.0.467.

GHSA-3pc2-fm7p-q2vgLowCVSS 3.7

Cross-site Scripting in October

Vendor

GitHub Security Advisories

Published

July 2, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2020-4061 →

📋 Description

Impact

Pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack.

Patches

Issue has been patched in Build 467 (v1.0.467).

Workarounds

Apply https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 to your installation manually if unable to upgrade to Build 467.

References

https://research.securitum.com/the-curious-case-of-copy-paste/

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

Threat Assessment

Assessed as Low given that by the nature of the attack it can only impact users that do it to themselves by copying and pasting from malicious websites.

Acknowledgements

Thanks to Michał Bentkowski of Securitum for finding the original issue in Froala and @tomaszstrojny for reporting the issue to the October CMS team.

🎯 Affected products1

composer/october/backend:>= 1.0.319, < 1.0.467