Staz0T

**Name of the Vulnerable Software and Affected Versions** October CMS versions 1.0.319 through 1.0.465 RainLab.Blog plugin versions prior to 1.4.1 **Description** A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This issue has been fixed by restricting the ability to store JS in markdown to only users that have been explicitly granted the `backend.allow unsafe markdown` permission. **Recommendations** For October CMS versions 1.0.319 through 1.0.465, update to version 1.0.466 or later. For RainLab.Blog plugin versions prior to 1.4.1, update to version 1.4.1 or later. As a temporary workaround, consider applying the manual patches to your installation if unable to upgrade to the fixed versions.

**Name of the Vulnerable Software and Affected Versions** Bolt CMS versions prior to 3.7.1 **Description** The issue is related to the lack of proper CSRF protection in the preview generating endpoint. This endpoint is intended for use by authorized users such as admins, developers, chief-editors, and editors to generate previews of content. However, due to the lack of CSRF protection, unauthorized users could also generate previews. **Recommendations** For versions prior to 3.7.1, update to version 3.7.1 to resolve the issue. As a temporary workaround, consider restricting access to the preview generating endpoint to minimize the risk of unauthorized preview generation.

**Name of the Vulnerable Software and Affected Versions** Bolt CMS versions prior to 3.7.1 **Description** The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. **Recommendations** For versions prior to 3.7.1, update to Bolt 3.7.1 to resolve the issue. As a temporary workaround, consider restricting the ability to rename uploaded files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OctoberCMS versions 1.0.319 through 1.0.465 **Description** An attacker can exploit this issue to read local files of an October CMS server. The issue is only exploitable by an authenticated backend user with the `cms.manage assets` permission. **Recommendations** For versions 1.0.319 through 1.0.465, update to Build 466 (v1.0.466) to resolve the issue. As a temporary workaround for versions that cannot be updated to Build 466, apply the patch from https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc to your installation manually.

**Name of the Vulnerable Software and Affected Versions** OctoberCMS versions 1.0.319 through 1.0.465 **Description** An attacker can exploit this issue to delete arbitrary local files of an October CMS server. The issue is only exploitable by an authenticated backend user with the `cms.manage assets` permission. **Recommendations** For versions 1.0.319 through 1.0.465, update to Build 466 (v1.0.466) to resolve the issue. As a temporary workaround, consider applying the patch from https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc to your installation manually if unable to upgrade to Build 466.

**Name of the Vulnerable Software and Affected Versions** OctoberCMS versions 1.0.319 through 1.0.465 **Description** An attacker can exploit this issue to upload various file types, including jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, and xml files, to any directory of an October CMS server. The issue is only exploitable by an authenticated backend user with the `cms.manage assets` permission. **Recommendations** For versions 1.0.319 through 1.0.465, update to Build 466 (v1.0.466) to resolve the issue. As a temporary workaround, consider applying the patch from https://github.com/octobercms/october/commit/6711dae8ef70caf0e94cec434498012a2ccd86b8 to your installation manually if unable to upgrade to Build 466.

**Name of the Vulnerable Software and Affected Versions** OctoberCMS versions 1.0.319 through 1.0.465 **Description** A user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file, which could result in a reflected XSS attack on the user in question. **Recommendations** For versions 1.0.319 through 1.0.465, update to Build 466 (v1.0.466) to resolve the issue. As a temporary workaround, apply the patch from https://github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c to your installation manually if unable to upgrade to Build 466.