Lucene search

[email protected]CVE-2021-32650

HistoryJan 14, 2022 - 3:15 p.m.

CVE-2021-32650

2022-01-1415:15:07

CWE-94

CWE-74

[email protected]

web.nvd.nist.gov

cve-2021-32650

october cms

php execution

safe mode bypass

security patch

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

49.7%

JSON

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

Affected configurations

Vulners

NVD

Node

octobercmsoctoberRange<1.0.473

octobercmsoctoberRange1.1.0–1.1.6

VendorProductVersionCPE
octobercmsoctober*cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*
octobercmsoctober*cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
octobercms	october	*	cpe:2.3:a:octobercms:october::::::::
octobercms	october	*	cpe:2.3:a:octobercms:october::::::::

CNA Affected

[
  {
    "product": "october",
    "vendor": "octobercms",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.0.473"
      },
      {
        "status": "affected",
        "version": ">= 1.1.0, < 1.1.6"
      }
    ]
  }
]