PT-2020-12549 · Rain · October Cms Debugbar Plugin

Freddie Poser · Published 2020-06-03 · Updated 2020-06-10 · CVE-2020-11094

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions October CMS debugbar plugin versions prior to 3.1.0

Description The October CMS debugbar plugin contains a feature that logs all requests, including session data, when enabled. This poses a problem if the plugin is enabled on a system accessible to untrusted users, as they could use this feature to view requests and obtain sensitive information, potentially leading to account takeovers of authenticated users. An attacker could theoretically gain full access to the system if the required conditions exist.

Recommendations For versions prior to 3.1.0, update to version 3.1.0 or later, which locks down access to the debugbar and restricts the feature that allows access to stored request information behind a more restrictive permission. Alternatively, apply the patch manually from https://github.com/rainlab/debugbar-plugin/commit/86dd29f9866d712de7d98f5f9dc67751b82ecd18 if unable to upgrade to v3.1.0.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2020-11094

GHSA-C8WH-6JW4-2H79

Affected Products

October Cms Debugbar Plugin

References · 6

• https://github.com/rainlab/debugbar-plugin/commit/86dd29f9866d712de7d98f5f9dc67751b82ecd18 · Patch
• https://github.com/rainlab/debugbar-plugin/security/advisories/GHSA-c8wh-6jw4-2h79 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11094 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11094 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c8wh-6jw4-2h79 · Vendor Advisory
• https://t.me/cvenotify/4186 · Telegram Post