PT-2022-23050 · Unknown · October Cms

Cydave + 1 · Published 2022-10-13 · Updated 2022-10-18 · CVE-2022-35944

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions October CMS versions prior to 2.2.34 October CMS versions prior to 3.0.66

Description This issue affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. An attacker with access to the admin panel and permission to open the "Editor" section can bypass the Safe Mode (cms.safe mode) restriction to introduce new PHP code in a CMS template using a specially crafted request.

Recommendations For versions prior to 2.2.34, update to version 2.2.34 or later. For versions prior to 3.0.66, update to version 3.0.66 or later. As a temporary workaround, consider restricting access to the "Editor" section in the admin panel until a patch is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-35944

GHSA-X4Q7-M6FP-4V9V

Affected Products

October Cms

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35944.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35944 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35944 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x4q7-m6fp-4v9v · Vendor Advisory
• https://github.com/octobercms/october · Note
• https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v · Note
• https://t.me/cibsecurity/51367 · Telegram Post