CVE-2020-5296

Katalog CVE

CVSS 4.9 · Medium EPSS 1,4%

Kerentanan External Control of File Name or Path pada octobercms october. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Rincian

Terbit di NVD

3 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path
CWE-610: Externally Controlled Reference to a Resource in Another Sphere

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc patch · advisory pihak ketiga
• https://github.com/octobercms/october/security/advisories/GHSA-jv6v-fvvx-4932 patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.ht... exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Aug/2 exploit · mailing list · advisory pihak ketiga