CVE-2020-5295

Katalog CVE

CVSS 4.9 · Medium EPSS 7,4%

Kerentanan Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') pada octobercms october. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Rincian

Terbit di NVD

3 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

7,4% peluang dieksploitasi; lebih tinggi dari 94,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc patch · advisory pihak ketiga
• https://github.com/octobercms/october/security/advisories/GHSA-r23f-c2j5-rx2f patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.ht... exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Aug/2 exploit · mailing list · advisory pihak ketiga