GitHub Advisoryadvisory · Packagist

GHSA-8vh6-8w76-v6m3 October CMS File Upload Vulnerability

CRITICAL Published 2022-05-13 Modified 2023-07-25 Official page ↗
Aliases
CVE-2017-1000194
Ecosystem
Packagist
Packages
october/october
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2023-07-25

Affected packages

• Packagist october/october: < 1.0.413 → fixed in 1.0.413

Description

October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server.

Related

Alias · CVE (1)

  • CVE-2017-1000194 October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References