Remote Code Execution (RCE)

2022-02-2404:34:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.005 Low

EPSS

Percentile

77.0%

JSON

October CMS is vulnerable to remote code execution. The vulnerability exists because the library does not properly sanitize the user input before rendering, allowing an attacker who has access to the backend can manipulate web pages via cms.safe_mode or cms.enableSafeMode to execute arbitrary code.

CPENameOperatorVersion
october/systemlev1.0.474
october/systemlev1.1.10
october/octoberlev1.0.474
october/octoberlev2.1.27
october/octoberlev1.1.10
october/octoberlev2.1.29 
october/octoberlev3.0.2
october/systemlev1.0.474
october/systemlev1.1.10
october/octoberlev1.0.474

Name	Operator	Version
october/system	le	v1.0.474
october/system	le	v1.1.10
october/october	le	v1.0.474
october/october	le	v2.1.27
october/october	le	v1.1.10
october/october	le	v2.1.29
october/october	le	v3.0.2
october/system	le	v1.0.474
october/system	le	v1.1.10
october/october	le	v1.0.474