Vulnerability in Octobercms October
CVE-2020-15128
In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. Issue has been fixed in build 468 (v1.0.468).
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.007 (50.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Octobercms October — versions < 1.0.468
Weakness classification (CWE)
References
- github.com/octobercms/october/security/advisories/GHSA-55mm-5399-7r63 (Third Party Advisory)
- github.com/octobercms/library/pull/508 (Patch, Third Party Advisory)
- github.com/octobercms/library/commit/28310d4fb336a1741b39498f4474497644a6875c (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-15128?
- CVE-2020-15128 is a medium-severity vulnerability in Octobercms October, classified under Reliance on Cookies without Validation and Integrity Checking. CVSS score: 6.1/10. Published 2020-07-31.
- How severe is CVE-2020-15128?
- Medium severity. CVSS v3 base score is 6.1 out of 10.