CVE-2020-5297

Katalog CVE

CVSS 2.7 · Low EPSS 1,2%

Kerentanan External Control of File Name or Path pada octobercms october. Skor CVSS 3.1 2.7 (Low) menurut NVD.

Deskripsi (NVD)

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Rincian

Terbit di NVD

3 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

2.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path
CWE-610: Externally Controlled Reference to a Resource in Another Sphere

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/octobercms/october/commit/6711dae8ef70caf0e94cec434498012a2ccd86b8 patch · advisory pihak ketiga
• https://github.com/octobercms/october/security/advisories/GHSA-9722-rr68-rfpg patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.ht... exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Aug/2 exploit · mailing list · advisory pihak ketiga