Authenticated file write leads to remote code execution in october/system
CVE-2021-32649

8.8HIGH

Key Information:

Vendor

Octobercms

Status
October
Vendor
CVE Published:
14 January 2022

What is CVE-2021-32649?

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

Affected Version(s)

october < 1.0.473 < 1.0.473

october >= 1.1.0, < 1.1.6 < 1.1.0, 1.1.6

References

https://github.com/octobercms/october/commit/167b592eed29...
x_refsource_MISC
https://github.com/octobercms/october/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.