GitHub Advisoryadvisory · Packagist

GHSA-v7cr-w5v6-6659 October CMS Local File Inclusion

HIGH Published 2022-05-13 Modified 2023-07-21 Official page ↗
Aliases
CVE-2018-1999009
Ecosystem
Packagist
Packages
october/october
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2023-07-21

Affected packages

• Packagist october/october: < 1.0.437 → fixed in 1.0.437

Description

October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.

Related

Alias · CVE (1)

  • CVE-2018-1999009 October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References