Remote Code Execution (RCE) Affecting october/october package, versions >=1.0.319, <1.0.469
Snyk CVSS
Attack Complexity
High
Privileges Required
High
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
EPSS
0.04% (12th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-OCTOBEROCTOBER-1044027
- published 24 Nov 2020
- disclosed 24 Nov 2020
- credit ka1n4t
Introduced: 24 Nov 2020
CVE-2020-15247 Open this link in a new tabHow to fix?
Upgrade october/october to version 1.0.469 or higher.
Overview
Affected versions of this package are vulnerable to Remote Code Execution (RCE). An authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP.