CVE-2020-5296 — External Control of File Name or Path in October

CWE-73 — External Control of File Name or PathCWE-610 — Externally Controlled Reference to a Resource in Another Sphere3 documents3 sources
Severity
4.9MEDIUMNVD
EPSS
0.6%
top 29.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Octobercms OctoberOctober CMS
Timeline
PublishedJun 3

Description

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages3 packages

▶NVDoctobercms/october1.0.319 — 1.0.466
▶CVEListV5octobercms/october>= 1.0.319, < 1.0.466
▶Packagistoctober/cms1.0.319 — 1.0.466

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
Arbitrary File Deletion vulnerability in OctoberCMS↗2020-06-03
▶
OSV
Arbitrary File Deletion vulnerability in OctoberCMS↗2020-06-03
▶