CVSS: 5.2EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21264 – Bypass of fix for CVE-2020-26231, Twig sandbox escape
https://notcve.org/view.php?id=CVE-2021-21264
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 472 (v1.0.472) and v1.1.2. • https://github.com/octobercms/october/security/advisories/GHSA-fcr8-6q7r-m4wg • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21265 – Potential Host Header Poisoning on misconfigured servers
https://notcve.org/view.php?id=CVE-2021-21265
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force. October es una plataforma CMS gratuita, de código abierto y autoinvitada basada en Laravel PHP Framework. • https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp • CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-3311
https://notcve.org/view.php?id=CVE-2021-3311
An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker. Se detectó un problema en October hasta el build 471. Reactiva una ID de una sesión anterior (que había sido no válida después de cerrar la sesión) una vez que se produce un nuevo inicio de sesión. • https://anisiosantos.me/october-cms-token-reactivation https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 https://octobercms.com/forum/chan/announcements • CWE-613: Insufficient Session Expiration •
CVSS: 6.7EPSS: 0%CPEs: 2EXPL: 0CVE-2020-26231 – Bypass of fix for CVE-2020-15247, Twig sandbox escape
https://notcve.org/view.php?id=CVE-2020-26231
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discovered that has the same impact as CVE-2020-15247. An authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having cms.enableSafeMode enabled, but would be a problem for anyone relying on cms.enableSafeMode to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 470 (v1.0.470) and v1.1.1. • https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7 https://github.com/octobercms/october/security/advisories/GHSA-r89v-cgv7-3jhx • CWE-862: Missing Authorization •