PT-2020-18386 · October · October Cms

Sivanesh Ashok + 1 · Published 2020-06-03 · Updated 2022-06-30 · CVE-2020-5297

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OctoberCMS versions 1.0.319 through 1.0.465

Description An attacker can exploit this issue to upload various file types, including jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, and xml files, to any directory of an October CMS server. The issue is only exploitable by an authenticated backend user with the cms.manage assets permission.

Recommendations For versions 1.0.319 through 1.0.465, update to Build 466 (v1.0.466) to resolve the issue. As a temporary workaround, consider applying the patch from https://github.com/octobercms/october/commit/6711dae8ef70caf0e94cec434498012a2ccd86b8 to your installation manually if unable to upgrade to Build 466.

Exploit

Fix

Weakness Enumeration

CWE-73

CWE-610

Related Identifiers

CVE-2020-5297

GHSA-9722-RR68-RFPG

Affected Products

October Cms

References · 9

• 🔥 http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Aug/2 · Exploit
• https://github.com/octobercms/october/commit/6711dae8ef70caf0e94cec434498012a2ccd86b8 · Patch
• https://github.com/octobercms/october/security/advisories/GHSA-9722-rr68-rfpg · Patch
• https://osv.dev/vulnerability/CVE-2020-5297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5297 · Security Note
• https://osv.dev/vulnerability/GHSA-9722-rr68-rfpg · Vendor Advisory
• https://t.me/cvenotify/4177 · Telegram Post
• https://t.me/cvenotify/32417 · Telegram Post