CVE-2020-15248

creationtimestamp| type| source ---|---|--- 2020-11-23 22:45:59+00:00| seen| https://t.me/cibsecurity/16730...

CVE-2020-15248

CVE-2020-15248 affects October CMS prior to 1.0.470 (and 1.0.470+ in 1.0 line), where backend users with the default Publisher role can create/manage users and assign roles, enabling privilege escalation to Developer. Root cause: insecure authorization in user-creation workflow allows escalation....

CVE-2020-15248 Privilege escalation by backend users assigned to the default "Publisher" system role

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user ha...