PT-2022-10089 · Unknown · October Cms

Cydave + 1 · CVE-2021-32649 · Published 2022-01-14 · Updated 2022-08-05

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions October CMS versions prior to 1.0.473 and 1.1.6

Description The issue allows an attacker with "create, modify and delete website pages" privileges in the backend to execute PHP code by running specially crafted Twig code in the template markup.

Recommendations For versions prior to 1.0.473, update to version 1.0.473 or apply the patch to the installation manually as a workaround. For versions prior to 1.1.6, update to version 1.1.6 or apply the patch to the installation manually as a workaround.

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2021-32649

GHSA-WV23-PFJ7-2MJJ

Affected Products

October Cms

References · 7

• https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 · Patch
• https://github.com/octobercms/october/security/advisories/GHSA-wv23-pfj7-2mjj · Patch
• https://osv.dev/vulnerability/CVE-2021-32649 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wv23-pfj7-2mjj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32649 · Security Note
• https://github.com/octobercms/october · Note
• https://t.me/cibsecurity/35505 · Telegram Post