PT-2020-14208 · October · October Cms

Takashi Terada + 1 · Published 2020-07-31 · Updated 2022-04-25 · CVE-2020-15128

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OctoberCMS versions prior to 1.0.468

Description The issue concerns encrypted cookie values not being tied to the name of the cookie, potentially allowing certain classes of attacks to succeed if other vulnerabilities in user-facing code are present. Specifically, if user input is stored in a cookie and returned to the user, they could use the generated cookie in place of more tightly controlled cookies. Alternatively, if the plaintext version of an encrypted cookie is exposed to the user, they could provide encrypted content from the application back to it as an encrypted cookie, forcing the framework to decrypt it.

Recommendations For versions prior to 1.0.468, update to version 1.0.468 or later to fix the issue. As a temporary workaround, consider applying the patch from https://github.com/octobercms/library/commit/28310d4fb336a1741b39498f4474497644a6875c to your installation manually if unable to upgrade to Build 468. Note that if using the cookie session driver, all session data will be invalidated, and users will need to log in again once their current session expires.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-565

CWE-327

Related Identifiers

CVE-2020-15128

GHSA-55MM-5399-7R63

Affected Products

October Cms

References · 6

• https://github.com/octobercms/library/commit/28310d4fb336a1741b39498f4474497644a6875c · Patch
• https://github.com/octobercms/library/pull/508 · Patch
• https://osv.dev/vulnerability/CVE-2020-15128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15128 · Security Note
• https://osv.dev/vulnerability/GHSA-55mm-5399-7r63 · Vendor Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-55mm-5399-7r63 · Note