CVE Vulnerability

CVE-2020-15248

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. Issue has been patched in Build 470 (v1.0.470) & v1.1.1.

4.6 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

4.2 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/octobercms/october/commit/78a37298a4ed4602b383522344a31e311402d829 Patch Third Party Advisory
https://github.com/octobercms/october/security/advisories/GHSA-rfjc-xrmf-5vvw Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*
Information

Published : 2020-11-23 08:15

Updated : 2021-11-18 04:28

NVD link : CVE-2020-15248

Mitre link : CVE-2020-15248

Products Affected
No products.
CWE
CWE-269