Description
October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| octobercms | october | >= 4.0.0, < 4.1.16, < 3.7.16 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | october/system | < 3.7.16 | 3.7.16 | GHSA-jj38-h5w5-mvpf |
| Packagist | october/system | >= 4.0.0 | — | GHSA-jj38-h5w5-mvpf |