Bypass of fix for CVE-2020-26231, Twig sandbox escape

Impact A bypass of CVE-2020-26231 fixed in 1.0.470/471 and 1.1.1 was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247: An authenticated backend user with the cms.managepages, cms.managelayouts, or cms.managepartials permissions who would normally not be permitted to provide...

GHSA-FCR8-6Q7R-M4WG Bypass of fix for CVE-2020-26231, Twig sandbox escape

Impact A bypass of CVE-2020-26231 fixed in 1.0.470/471 and 1.1.1 was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247: An authenticated backend user with the cms.managepages, cms.managelayouts, or cms.managepartials permissions who would normally not be permitted to provide...

Cross-site Scripting (XSS) - Stored in octobercms/library

✍️ Description OctoberCMS uses october/rain library to handle file uploads. Previously it was possible to upload malicious files with HTML content to the CMS via its Media upload feature. This security issue marked as CVE-2020-15249 was fixed in 1.0.469. But it is still possible to upload XML...

Octobercms Code Issues Vulnerabilities

Octobercms is a Php based Cms website builder from Octobercms, Inc. A security vulnerability exists in Octobercms through build 471, which stems from the fact that it reactivates old session IDs when a new login occurs...

Bypass of fix for CVE-2020-15247, Twig sandbox escape

Impact A bypass of CVE-2020-15247 fixed in 1.0.469 and 1.1.0 was discovered that has the same impact as CVE-2020-15247: An authenticated backend user with the cms.managepages, cms.managelayouts, or cms.managepartials permissions who would normally not be permitted to provide PHP code to be execut...

Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.

Impact An authenticated backend user with the cms.managepages, cms.managelayouts, or cms.managepartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig...

GHSA-RFJC-XRMF-5VVW Privilege escalation by backend users assigned to the default "Publisher" system role

Impact Backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. Patches Issue has been patched in...

Reliance on Cookies without validation in OctoberCMS

Impact Previously encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code nothing exploitable in the core project itself had a higher chance of...

CVE-2020-15128

In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code nothing exploitable in the core project itself had a...

CVE-2020-15128

In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code nothing exploitable in the core project itself had a...

Design/Logic Flaw

In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code nothing exploitable in the core project itself had a...

CVE-2020-15128

CVE-2020-15128 affects OctoberCMS prior to version 1.0.468. The root cause is that encrypted cookie values were not bound to the cookie name, enabling scenarios where untrusted user input stored in a cookie could be misused as other cookies or where plaintext cookie content could be fed back for ...

CVE-2020-15128 Reliance on Cookies without validation in OctoberCMS

In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code nothing exploitable in the core project itself had a...

CVE-2020-15128: Reliance on Cookies without Validation and Integrity Checking

In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code nothing exploitable in the core project itself had a...

Cross-site Scripting (XSS)

october/october is vulnerable to cross-site scripting XSS. The vulnerability exists as it does not perform sanitization on the clipboard before pasting it in a FroalaEditor...

GHSA-V73W-R9XG-7CR9 Use of insecure jQuery version in OctoberCMS

Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches Issue has been patched in Build 466 v1.0.466 by applying the recommended patch from @jquery. Workarounds Apply...

Use of insecure jQuery version in OctoberCMS

Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches Issue has been patched in Build 466 v1.0.466 by applying the recommended patch from @jquery. Workarounds Apply...

Unauthorized Local File Read

octobercms is vulnerable to unrestricted local file read. The vulnerability is possible because it does not restrict the file path to read the files under the assets directory, allowing any authenticated backend user with the cms.manageassets permission to read local files of an October CMS serve...

Cross-Site Scripting (XSS)

OctoberCMS is vulnerable to cross-site scripting XSS. The attack is possible because it does not prevent uploading of malicious CSV file by sanitizing the imported CSV column names column parameters...

Unrestricted File Upload

OctoberCMS is vulnerable to Unrestricted File Upload. It does not trim and validate the path destinationFullPath, allowing an authenticated backend user with the cms.manageassets permission to upload files such as jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md,...