PT-2018-15194 · October · October Cms

Publicado 2018-07-23 · Atualizado 2022-05-13 · CVE-2018-1999009

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions October CMS versions prior to Build 437

Description The issue is related to a Local File Inclusion vulnerability in the makeFileContents function within modules/system/traits/ViewMaker.php. This can lead to sensitive information disclosure and remote code execution. The attack appears to be exploitable remotely if the /backend path is accessible.

Recommendations For October CMS versions prior to Build 437, update to Build 437 or later to resolve the issue. As a temporary workaround, consider restricting access to the /backend path to minimize the risk of exploitation. Additionally, limiting the use of the makeFileContents function in ViewMaker.php until the update can be applied may help mitigate the risk.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-1999009

GHSA-V7CR-W5V6-6659

Produtos afetados

October Cms

Referências · 5

• https://github.com/octobercms/october · Nota
• https://osv.dev/vulnerability/GHSA-v7cr-w5v6-6659 · Aviso do Fabricante
• http://octobercms.com/support/article/rn-10 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999009 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1999009 · Aviso do Fabricante