PT-2018-15194 · October · October Cms

Published 2018-07-23 · Updated 2022-05-13 · CVE-2018-1999009

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions October CMS versions prior to Build 437

Description The issue is related to a Local File Inclusion vulnerability in the makeFileContents function within modules/system/traits/ViewMaker.php. This can lead to sensitive information disclosure and remote code execution. The attack appears to be exploitable remotely if the /backend path is accessible.

Recommendations For October CMS versions prior to Build 437, update to Build 437 or later to resolve the issue. As a temporary workaround, consider restricting access to the /backend path to minimize the risk of exploitation. Additionally, limiting the use of the makeFileContents function in ViewMaker.php until the update can be applied may help mitigate the risk.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-1999009

GHSA-V7CR-W5V6-6659

Affected Products

October Cms

References · 5

• https://osv.dev/vulnerability/GHSA-v7cr-w5v6-6659 · Vendor Advisory
• http://octobercms.com/support/article/rn-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999009 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1999009 · Vendor Advisory
• https://github.com/octobercms/october · Note