CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2021-3311
https://notcve.org/view.php?id=CVE-2021-3311
05 Feb 2021 — An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker. Se detectó un problema en October hasta el build 471. Reactiva una ID de una sesión anterior (que había sido no válida después de cerrar la sesión) una vez que se produce un nuevo inicio de sesión. • https://anisiosantos.me/october-cms-token-reactivation • CWE-613: Insufficient Session Expiration •
CVSS: 6.7EPSS: 0%CPEs: 2EXPL: 0CVE-2020-26231 – Bypass of fix for CVE-2020-15247, Twig sandbox escape
https://notcve.org/view.php?id=CVE-2020-26231
23 Nov 2020 — October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discovered that has the same impact as CVE-2020-15247. An authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and exe... • https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7 • CWE-862: Missing Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15249 – Stored XSS by authenticated backend user with access to upload files
https://notcve.org/view.php?id=CVE-2020-15249
23 Nov 2020 — October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under the website's domain (i.e. /storage/app/media/evil.svg), but they ... • https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15248 – Privilege escalation by backend users assigned to the default "Publisher" system role
https://notcve.org/view.php?id=CVE-2020-15248
23 Nov 2020 — October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. Issue has been patched in Build 470 (v1.0.470) & v1.1.1. October es una plataforma CMS gratuita, de c... • https://github.com/octobercms/october/commit/78a37298a4ed4602b383522344a31e311402d829 • CWE-269: Improper Privilege Management CWE-863: Incorrect Authorization •
CVSS: 5.2EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15247 – Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.
https://notcve.org/view.php?id=CVE-2020-15247
23 Nov 2020 — October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyon... • https://github.com/octobercms/october/commit/4c650bb775ab849e48202a4923bac93bd74f9982 • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2020-15246 – Local File Inclusion by unauthenticated users
https://notcve.org/view.php?id=CVE-2020-15246
23 Nov 2020 — October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an attacker can read local files on an October CMS server via a specially crafted request. Issue has been patched in Build 469 (v1.0.469) and v1.1.0. October es una plataforma CMS gratuita, de código abierto y autohosteada basada en Laravel PHP Framework. En el CMS de octubre desde la versión 1.0.421 y anterior a versión 1.0.469, un atacante puede ... • https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-863: Incorrect Authorization •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15128 – Reliance on Cookies without validation in OctoberCMS
https://notcve.org/view.php?id=CVE-2020-15128
31 Jul 2020 — In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a... • https://github.com/octobercms/library/commit/28310d4fb336a1741b39498f4474497644a6875c • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 3CVE-2020-11083 – Stored XSS in October
https://notcve.org/view.php?id=CVE-2020-11083
14 Jul 2020 — In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1. En octubre, desde versión 1.0.319 y anterior a versión 1.0.466, un usuario con acceso a un FormWidget de descuento que almacena datos persistentemente ... • https://packetstorm.news/files/id/158730 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-4061 – Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites
https://notcve.org/view.php?id=CVE-2020-4061
02 Jul 2020 — In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467. En October desde versión 1.0.319 y anteriores a versión 1.0.467, al pegar contenido copiado desde sitios web maliciosos en el Froala richeditor podría resultar en un ataque con éxito de tipo auto-XSS. Esto ha sido corregido en versión 1.0.467 • https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11094 – Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar
https://notcve.org/view.php?id=CVE-2020-11094
03 Jun 2020 — The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potential exists for them to use this feature to view all requests being made to the application and obtain sensitive information from those requests. There even exists the potential for account takeovers of ... • https://github.com/rainlab/debugbar-plugin/commit/86dd29f9866d712de7d98f5f9dc67751b82ecd18 • CWE-532: Insertion of Sensitive Information into Log File •