CVE-2023-44383

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-443844.1Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administra CVE-2023-443858.8The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send ma CVE-2023-443865.3Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The CVE-2023-443876.5Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked file CVE-2023-443887.5Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thu CVE-2023-443894.8Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is CVE-2023-44395.3A vulnerability was found in SourceCodester Card Holder Management System 1.0 and classified as problematic. Affected by this issue is some CVE-2023-443906.1HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability oc CVE-2023-443915.3Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profil CVE-2023-443929.0Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cry CVE-2023-443936.1Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in CVE-2023-443944.3MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Pr