CVE-2024-25637
Reflected XSS via X-October-Request-Handler Header
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a proxy interception tool. This issue has been patched in version 3.5.15.
October es una plataforma CMS autohospedada basada en Laravel PHP Framework. El encabezado X-October-Request-Handler no sanitiza el nombre del controlador AJAX y permite que se refleje HTML sin escape. No hay ningún impacto ya que esta vulnerabilidad no se puede explotar mediante interacciones normales del navegador. Este valor sin escape solo es detectable cuando se utiliza una herramienta de interceptación de proxy. Este problema se solucionó en la versión 3.5.15.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-02-08 CVE Reserved
- 2024-06-26 CVE Published
- 2024-06-27 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL | Tag | Source |
---|---|---|
https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563 | X_refsource_confirm |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Octobercms Search vendor "Octobercms" | October Search vendor "Octobercms" for product "October" | >= 3.2.0 < 3.5.15 Search vendor "Octobercms" for product "October" and version " >= 3.2.0 < 3.5.15" | en |
Affected
|