{"id":"CVE-2023-43876","aliases":["EUVD-2023-2393","GHSA-2g8p-j2r6-vqpj"],"status":"published","title":"Withdrawn Advisory: October Cross-site Scripting vulnerability","description":"A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00477,"percentile":0.41453,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2023-09-28T00:00:00Z","modified":"2026-09-10T03:50:03Z","exploits":[{"source":"pocgithub","id":"sromanhu/CVE-2023-43876-October-CMS-Reflected-XSS---Installation","title":"sromanhu/CVE-2023-43876-October-CMS-Reflected-XSS---Installation","date":"2023-09-19","url":"https://github.com/sromanhu/CVE-2023-43876-October-CMS-Reflected-XSS---Installation"}],"products":[{"vendor":"octobercms","product":"october"}],"references":[{"url":"https://github.com/sromanhu/October-CMS-Reflected-XSS---Installation/blob/main/README.md","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43876","tags":["advisory"]},{"url":"https://github.com/sromanhu/CVE-2023-43876-October-CMS-Reflected-XSS---Installation/issues/1","tags":["web"]},{"url":"https://github.com/octobercms/install/commit/ef1225b5596b7c2eb5ca3aa700a23e9f8acf387b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2g8p-j2r6-vqpj"},{"url":"https://github.com/octobercms/install","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-43876","description":"A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.","status":"published","published":"2023-09-28T00:00:00Z","modified":"2024-09-23T19:17:11.047Z","updated_at":"2026-11-02T14:35:14.633899Z"}],"euvd":[{"id":"EUVD-2023-2393","description":"A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.","status":"published","published":"2023-09-28T00:00:00Z","modified":"2024-09-23T19:17:11Z","updated_at":"2026-11-03T00:28:16.548139Z"}],"ghsa":[{"id":"GHSA-2g8p-j2r6-vqpj","title":"Withdrawn Advisory: October Cross-site Scripting vulnerability","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because the vulnerability affects October CMS's installer, not October CMS. The installer deletes all folders and files upon completion of installation. The vulnerability is valid, but because October's installer is not part of one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems), alerts cannot be sent out for the correct package.\n\n## Corrected Description\nA Cross-Site Scripting (XSS) vulnerability in the installer of October CMS allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.","status":"withdrawn","published":"2023-09-28T15:30:17Z","modified":"2023-11-09T05:01:53Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:17.64478Z"}],"nvd":[{"id":"CVE-2023-43876","description":"A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.","status":"published","published":"2023-09-28T15:15:12.497Z","modified":"2026-06-17T06:26:37.06Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:31.699785Z"}],"osv":[{"id":"GHSA-2g8p-j2r6-vqpj","title":"Withdrawn Advisory: October Cross-site Scripting vulnerability","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because the vulnerability affects October CMS's installer, not October CMS. The installer deletes all folders and files upon completion of installation. The vulnerability is valid, but because October's installer is not part of one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems), alerts cannot be sent out for the correct package.\n\n## Corrected Description\nA Cross-Site Scripting (XSS) vulnerability in the installer of October CMS allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.","status":"withdrawn","published":"2023-09-28T15:30:17Z","modified":"2026-09-10T03:50:03.132854716Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:34.338541Z"}]}}