Multiple vulnerabilities in October CMS

Published: 2020-11-30

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2020-15248 CVE-2020-26231
CWE-ID	CWE-264 CWE-94
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	October CMS Web applications / CMS
Vendor	OctoberCMS

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU48708

Risk: Medium

CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-15248

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions. A remote user with "Publisher" access can escalate their permission to "Developer" access.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

October CMS: 1.0.319 - 1.0.469

External links

http://github.com/octobercms/october/commit/78a37298a4ed4602b383522344a31e311402d829
http://github.com/octobercms/october/security/advisories/GHSA-rfjc-xrmf-5vvw

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Code Injection

EUVDB-ID: #VU48710

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26231

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.