Kurz gesagt
- CVE-2020-15246 ist eine Schwachstelle (HOCH (CVSS 7.5)) in october/cms, october (octobercms).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.7%, höher als bei 77.2% aller Schwachstellen.
- Abhilfe: auf 1.0.469 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| october/cms Packagist | ≥ 1.0.421, < 1.0.469
| 1.0.469
|
| october | ≥ 1.0.421, < 1.0.469
| 1.0.469
|
Description
Impact
An attacker can exploit this vulnerability to read local files on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request.
Patches
Issue has been patched in Build 469 (v1.0.469) and v1.1.0.
Workarounds
Apply https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469.
References
Reported by ka1n4t
For more information
If you have any questions or comments about this advisory:
Threat assessment:
<img width="1105" alt="Screen Shot 2020-10-10 at 1 05 19 PM" src="https://user-images.githubusercontent.com/7253840/95663086-4ffc4780-0af9-11eb-9bb6-fd40cf11c033.png">
NVD description
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an attacker can read local files on an October CMS server via a specially crafted request. Issue has been patched in Build 469 (v1.0.469) and v1.1.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free