Detections
Analytics
SCA: security update for october/backend (GHSA-gg6x-xx78-448c)
medium Tenable Self-Hosted Container Security Plugin ID 423575
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the
ability to use the import functionality of the `ImportExportController` behavior can be socially
engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS
attack on the user in question Issue has been patched in Build 466 (v1.0.466). (CVE-2020-5298)
See Also
Plugin Details
Severity: Medium
ID: 423575
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 3/29/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 8.67
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Low
Base Score: 3.5
Temporal Score: 2.7
Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS Score Source: CVE-2020-5298
CVSS v3
Risk Factor: Medium
Base Score: 4.8
Temporal Score: 4.3
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/3/2020
Vulnerability Publication Date: 6/3/2020
Reference Information
CVE: CVE-2020-5298