Low severity3.5NVD Advisory· Published Jul 14, 2020· Updated Jun 17, 2026
CVE-2020-11083
CVE-2020-11083
Description
In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
october/backendPackagist | >= 1.0.319, < 1.0.466 | 1.0.466 |
Affected products
3cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*range: >=1.0.319,<1.0.466
- (no CPE)range: >= 1.0.319, < 1.0.466
Patches
Vulnerability mechanics
References
7- github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746nvdPatchThird Party AdvisoryWEB
- github.com/octobercms/october/security/advisories/GHSA-w4pj-7p68-3vgvnvdPatchThird Party AdvisoryWEB
- github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94nvdPatchThird Party AdvisoryWEB
- packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.htmlnvdExploitThird Party AdvisoryVDB EntryWEB
- seclists.org/fulldisclosure/2020/Aug/2nvdExploitMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-w4pj-7p68-3vgvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-11083ghsaADVISORY
News mentions
0No linked articles in our index yet.