PT-2023-29217 · October · October

Aftspunk + 1 · Published 2023-11-29 · Updated 2023-12-06 · CVE-2023-44382

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions October versions prior to 3.4.15

Description The issue allows an authenticated backend user with the editor.cms pages, editor.cms layouts, or editor.cms partials permissions to write specific Twig code and execute arbitrary PHP, despite cms.safe mode being enabled. This is problematic for those relying on cms.safe mode to restrict users from writing and executing arbitrary PHP.

Recommendations For versions prior to 3.4.15, update to version 3.4.15 to resolve the issue. As a temporary workaround, consider removing the editor.cms pages, editor.cms layouts, or editor.cms partials permissions from untrusted users.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-44382

GHSA-P8Q3-H652-65VX

Affected Products

October

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44382.json · Exploit
• https://github.com/octobercms/october/security/advisories/GHSA-p8q3-h652-65vx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-44382 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p8q3-h652-65vx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44382 · Security Note
• https://github.com/octobercms/october · Note
• https://t.me/cvenotify/62024 · Telegram Post
• https://t.me/cvenotify/62610 · Telegram Post
• https://t.me/cvenotify/61964 · Telegram Post