Vulnerabilities > CVE-2020-15247 - Unspecified vulnerability in Octobercms October

CVSS 4.4 - MEDIUM

Attack vector

LOCAL

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

local

octobercms

NVD

Published: 2020-11-23

Updated: 2021-11-18

Summary

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having cms.enableSafeMode enabled, but would be a problem for anyone relying on cms.enableSafeMode to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

Vulnerable Configurations

Part	Description	Count
Application	Octobercms Octobercms October 1.0.319 Octobercms October 1.0.320 Octobercms October 1.0.321 Octobercms October 1.0.322 Octobercms October 1.0.323 Octobercms October 1.0.324 Octobercms October 1.0.325 Octobercms October 1.0.326 Octobercms October 1.0.327 Octobercms October 1.0.328 Octobercms October 1.0.329 Octobercms October 1.0.330 Octobercms October 1.0.331 Octobercms October 1.0.332 Octobercms October 1.0.333 Octobercms October 1.0.334 Octobercms October 1.0.335 Octobercms October 1.0.336 Octobercms October 1.0.337 Octobercms October 1.0.338 Octobercms October 1.0.339 Octobercms October 1.0.340 Octobercms October 1.0.341 Octobercms October 1.0.342 Octobercms October 1.0.343 Octobercms October 1.0.344 Octobercms October 1.0.345 Octobercms October 1.0.346 Octobercms October 1.0.347 Octobercms October 1.0.348 Octobercms October 1.0.349 Octobercms October 1.0.350 Octobercms October 1.0.351 Octobercms October 1.0.352 Octobercms October 1.0.353 Octobercms October 1.0.354 Octobercms October 1.0.355 Octobercms October 1.0.356 Octobercms October 1.0.357 Octobercms October 1.0.358 Octobercms October 1.0.359 Octobercms October 1.0.360 Octobercms October 1.0.361 Octobercms October 1.0.362 Octobercms October 1.0.363 Octobercms October 1.0.364 Octobercms October 1.0.365 Octobercms October 1.0.366 Octobercms October 1.0.367 Octobercms October 1.0.368 Octobercms October 1.0.369 Octobercms October 1.0.370 Octobercms October 1.0.371 Octobercms October 1.0.372 Octobercms October 1.0.373 Octobercms October 1.0.374 Octobercms October 1.0.375 Octobercms October 1.0.376 Octobercms October 1.0.377 Octobercms October 1.0.378 Octobercms October 1.0.379 Octobercms October 1.0.380 Octobercms October 1.0.381 Octobercms October 1.0.382 Octobercms October 1.0.383 Octobercms October 1.0.384 Octobercms October 1.0.385 Octobercms October 1.0.386 Octobercms October 1.0.387 Octobercms October 1.0.388 Octobercms October 1.0.389 Octobercms October 1.0.390 Octobercms October 1.0.391 Octobercms October 1.0.392 Octobercms October 1.0.393 Octobercms October 1.0.394 Octobercms October 1.0.395 Octobercms October 1.0.396 Octobercms October 1.0.397 Octobercms October 1.0.398 Octobercms October 1.0.399 Octobercms October 1.0.400 Octobercms October 1.0.401 Octobercms October 1.0.402 Octobercms October 1.0.403 Octobercms October 1.0.404 Octobercms October 1.0.405 Octobercms October 1.0.406 Octobercms October 1.0.407 Octobercms October 1.0.408 Octobercms October 1.0.409 Octobercms October 1.0.410 Octobercms October 1.0.411 Octobercms October 1.0.412 Octobercms October 1.0.413 Octobercms October 1.0.414 Octobercms October 1.0.415 Octobercms October 1.0.416 Octobercms October 1.0.417 Octobercms October 1.0.418 Octobercms October 1.0.419 Octobercms October 1.0.420 Octobercms October 1.0.421 Octobercms October 1.0.422 Octobercms October 1.0.423 Octobercms October 1.0.424 Octobercms October 1.0.425 Octobercms October 1.0.426 Octobercms October 1.0.427 Octobercms October 1.0.428 Octobercms October 1.0.429 Octobercms October 1.0.430 Octobercms October 1.0.431 Octobercms October 1.0.432 Octobercms October 1.0.433 Octobercms October 1.0.434 Octobercms October 1.0.435 Octobercms October 1.0.436 Octobercms October 1.0.437 Octobercms October 1.0.438 Octobercms October 1.0.439 Octobercms October 1.0.440 Octobercms October 1.0.441 Octobercms October 1.0.442 Octobercms October 1.0.443 Octobercms October 1.0.444 Octobercms October 1.0.445 Octobercms October 1.0.446 Octobercms October 1.0.447 Octobercms October 1.0.448 Octobercms October 1.0.449 Octobercms October 1.0.450 Octobercms October 1.0.451 Octobercms October 1.0.452 Octobercms October 1.0.453 Octobercms October 1.0.454 Octobercms October 1.0.455 Octobercms October 1.0.456 Octobercms October 1.0.457 Octobercms October 1.0.458 Octobercms October 1.0.459 Octobercms October 1.0.460 Octobercms October 1.0.461 Octobercms October 1.0.462 Octobercms October 1.0.463 Octobercms October 1.0.464 Octobercms October 1.0.465 Octobercms October 1.0.466 Octobercms October 1.0.467 Octobercms October 1.0.468	150

Summary

Vulnerable Configurations

References