GitHub Advisoryadvisory · Packagist

GHSA-xwjr-6fj7-fc6h Local File Inclusion by unauthenticated users

HIGH Published 2020-11-23 Modified 2021-11-19 Official page ↗
Aliases
CVE-2020-15246
Ecosystem
Packagist
Packages
october/cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22, CWE-863
Reviewed
2020-11-23

Affected packages

• Packagist october/cms: >= 1.0.421, < 1.0.469 → fixed in 1.0.469

Description

Impact An attacker can exploit this vulnerability to read local files on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. Patches Issue has been patched in Build 469 (v1.0.469) and v1.1.0. Workarounds Apply https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469. References Reported by ka1n4t For more information If you have any questions or comments about this advisory: • Email us at [email protected] Threat assessment:

Related

Alias · CVE (1)

  • CVE-2020-15246 October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-863 Incorrect Authorization weakness

References