| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| october/backend | ≥ 1.0.319, < 1.0.467 | 1.0.467 |
| october | ≥ 1.0.319, < 1.0.467 | 1.0.467 |
Pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack.
Issue has been patched in Build 467 (v1.0.467).
Apply https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 to your installation manually if unable to upgrade to Build 467.
If you have any questions or comments about this advisory:
Assessed as Low given that by the nature of the attack it can only impact users that do it to themselves by copying and pasting from malicious websites.
Thanks to Michał Bentkowski of Securitum for finding the original issue in Froala and @tomaszstrojny for reporting the issue to the October CMS team.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン