PT-2020-16360 · October · October Cms

Ka1N4T · Published 2020-11-23 · Updated 2020-12-08 · CVE-2020-26231

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions October CMS versions prior to 1.0.470 October CMS versions prior to 1.1.1

Description A bypass was discovered that allows an authenticated backend user with the cms.manage pages, cms.manage layouts, or cms.manage partials permissions to write specific Twig code and execute arbitrary PHP, despite cms.enableSafeMode being enabled. This issue affects users who rely on cms.enableSafeMode to restrict access to writing and executing arbitrary PHP in production.

Recommendations For October CMS versions prior to 1.0.470, update to Build 470 (v1.0.470) or apply the patch from https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7 manually. For October CMS versions prior to 1.1.1, update to v1.1.1 or apply the patch from https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7 manually.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-26231

GHSA-R89V-CGV7-3JHX

Affected Products

October Cms

References · 8

• https://github.com/octobercms/october/security/advisories/GHSA-r89v-cgv7-3jhx · Patch
• https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7 · Patch
• https://osv.dev/vulnerability/GHSA-r89v-cgv7-3jhx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26231 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26231 · Vendor Advisory
• https://t.me/cibsecurity/16758 · Telegram Post
• https://t.me/cvenotify/6068 · Telegram Post
• https://github.com/advisories/GHSA-94vp-rmqv-5875 · Note