CVE-2023-44383: October CMS stored XSS by authenticated backend user with improper configuration
5.4
Basic Information
PHPTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| october/system | composer | >= 3.0.0, < 3.5.2 | 3.5.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper sanitization of SVG file uploads in the media manager component. While the patch introduces a 'clean_vectors' configuration to enable sanitization, the advisory and commit diff don't explicitly identify specific processing functions in the codebase. The vulnerability manifests due to the absence of sanitization logic in SVG handling routines when the configuration is disabled, but without access to the exact file processing functions in October CMS's MediaManager component (which isn't shown in provided diffs or descriptions), we can't confidently name specific vulnerable functions. The root cause is a missing security control (sanitization) rather than a clearly identifiable vulnerable function signature.