Vulnerability Details : CVE-2020-5295
Potential exploit
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
Vulnerability category: File inclusion
Products affected by CVE-2020-5295
- cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-5295
8.71%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 92 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-5295
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST | |
|
4.9
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
1.2
|
3.6
|
NIST | |
|
4.8
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
1.7
|
2.7
|
GitHub, Inc. |
CWE ids for CVE-2020-5295
-
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.Assigned by: security-advisories@github.com (Secondary)
-
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-5295
-
https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc
Improve asset file path handling · octobercms/october@2b8939c · GitHubPatch;Third Party Advisory
-
http://seclists.org/fulldisclosure/2020/Aug/2
Full Disclosure: October CMS <= Build 465 Multiple Vulnerabilities - Arbitrary File ReadExploit;Mailing List;Third Party Advisory
-
https://github.com/octobercms/october/security/advisories/GHSA-r23f-c2j5-rx2f
Local File Inclusion by authenticated backend user with cms.manage_assets permission · Advisory · octobercms/october · GitHubPatch;Third Party Advisory
-
http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html
October CMS Build 465 XSS / File Read / File Deletion / CSV Injection ≈ Packet StormExploit;Third Party Advisory;VDB Entry
Jump to