Local File Inclusion Vulnerability in October CMS by October
CVE-2018-1999009

8.1HIGH

Key Information:

Vendor

Octobercms

Status
October
Vendor
CVE Published:
3 October 2022

What is CVE-2018-1999009?

October CMS versions before Build 437 are susceptible to a Local File Inclusion vulnerability located in the makeFileContents function of modules/system/traits/ViewMaker.php. This vulnerability allows an attacker to potentially disclose sensitive information and execute remote code if the /backend path is accessible. The issue has been remediated in Build 437, underscoring the importance of keeping the software up-to-date to mitigate risks associated with such vulnerabilities.

References

http://octobercms.com/support/article/rn-10
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.