CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15128 – Reliance on Cookies without validation in OctoberCMS
https://notcve.org/view.php?id=CVE-2020-15128
In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. Issue has been fixed in build 468 (v1.0.468). En OctoberCMS versiones anteriores a 1.0.468, los valores de cookies cifrados no estaban enlazados al nombre de la cookie a la que pertenecía el valor. • https://github.com/octobercms/library/commit/28310d4fb336a1741b39498f4474497644a6875c https://github.com/octobercms/library/pull/508 https://github.com/octobercms/october/security/advisories/GHSA-55mm-5399-7r63 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2020-11083 – Stored XSS in October
https://notcve.org/view.php?id=CVE-2020-11083
In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1. En octubre, desde versión 1.0.319 y anterior a versión 1.0.466, un usuario con acceso a un FormWidget de descuento que almacena datos persistentemente podría crear un ataque de tipo XSS almacenado contra sí mismo y cualquier otro usuario con acceso al HTML generado desde el campo. Esto se ha corregido en 1.0.466. • http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html http://seclists.org/fulldisclosure/2020/Aug/2 https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746 https://github.com/octobercms/october/security/advisories/GHSA-w4pj-7p68-3vgv https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-4061 – Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites
https://notcve.org/view.php?id=CVE-2020-4061
In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467. En October desde versión 1.0.319 y anteriores a versión 1.0.467, al pegar contenido copiado desde sitios web maliciosos en el Froala richeditor podría resultar en un ataque con éxito de tipo auto-XSS. Esto ha sido corregido en versión 1.0.467 • https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 https://github.com/octobercms/october/security/advisories/GHSA-3pc2-fm7p-q2vg https://research.securitum.com/the-curious-case-of-copy-paste • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11094 – Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar
https://notcve.org/view.php?id=CVE-2020-11094
The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potential exists for them to use this feature to view all requests being made to the application and obtain sensitive information from those requests. There even exists the potential for account takeovers of authenticated users by non-authenticated public users, which would then lead to a number of other potential issues as an attacker could theoretically get full access to the system if the required conditions existed. Issue has been patched in v3.1.0 by locking down access to the debugbar to all users; it now requires an authenticated backend user with a specifically enabled permission before it is even usable, and the feature that allows access to stored request information is restricted behind a different permission that's more restrictive. El plugin debugbar de October CMS versiones anteriores a 3.1.0, contiene una funcionalidad donde registrará todas las peticiones (y toda la información relacionada con cada petición, incluidos los datos de la sesión) siempre que esté habilitada. • https://github.com/rainlab/debugbar-plugin/commit/86dd29f9866d712de7d98f5f9dc67751b82ecd18 https://github.com/rainlab/debugbar-plugin/security/advisories/GHSA-c8wh-6jw4-2h79 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5299 – Potential CSV Injection vector in OctoberCMS
https://notcve.org/view.php?id=CVE-2020-5299
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vulnerability in the victims spreadsheet software of choice. 2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software. • http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html http://seclists.org/fulldisclosure/2020/Aug/2 https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484 https://github.com/octobercms/october/security/advisories/GHSA-4rhm-m2fp-hx7q • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •