CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-32650 – Arbitrary code execution in october/system
https://notcve.org/view.php?id=CVE-2021-32650
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround. October CMS es una plataforma de sistema de administración de contenidos (CMS) auto alojada basada en el framework PHP Laravel. • https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 https://github.com/octobercms/october/security/advisories/GHSA-5hfj-r725-wpc4 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-29487 – Authentication bypass in Octobercms
https://notcve.org/view.php?id=CVE-2021-29487
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability to bypass authentication and takeover of and user account on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability. The issue has been patched in Build 472 and v1.1.5. octobercms en una plataforma CMS basada en el framework PHP Laravel. • https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 https://github.com/octobercms/october/security/advisories/GHSA-h76r-vgf3-j6w5 • CWE-287: Improper Authentication •
CVSS: 9.1EPSS: 2%CPEs: 2EXPL: 2CVE-2021-32648 – October CMS Improper Authentication
https://notcve.org/view.php?id=CVE-2021-32648
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. octobercms en una plataforma CMS basada en el Framework PHP Laravel. En las versiones afectadas del paquete october/system un atacante puede solicitar el restablecimiento de la contraseña de una cuenta y luego conseguir acceso a la misma mediante una petición especialmente diseñada. El problema ha sido parcheado en la Build 472 y en la versión v1.1.5. • https://github.com/Immersive-Labs-Sec/CVE-2021-32648 https://github.com/daftspunk/CVE-2021-32648 https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc • CWE-287: Improper Authentication •
CVSS: 5.2EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21264 – Bypass of fix for CVE-2020-26231, Twig sandbox escape
https://notcve.org/view.php?id=CVE-2021-21264
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 472 (v1.0.472) and v1.1.2. • https://github.com/octobercms/october/security/advisories/GHSA-fcr8-6q7r-m4wg • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21265 – Potential Host Header Poisoning on misconfigured servers
https://notcve.org/view.php?id=CVE-2021-21265
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force. October es una plataforma CMS gratuita, de código abierto y autoinvitada basada en Laravel PHP Framework. • https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp • CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax •