Account Takeover in Octobercms
Affected range
ECOSYSTEM: introduced 0; fixed 1.0.472ECOSYSTEM: introduced 1.1.1; fixed 1.1.5>=1.1.1,<1.1.5|<1.0.472Fixed versions: 1.0.472, 1.1.5
Vulnerability intelligence Composer
october/system
System module for October CMS
Composer latest 1.1.12 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
1.1.12
Published advisories match this version
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
25 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-p8q3-h652-65vx critical
October CMS safe mode bypass using Twig sandbox escape
Affected range
ECOSYSTEM: introduced 3.0.0; fixed 3.4.15>=3.0.0,<3.4.15Fixed versions: 3.4.15
GHSA-h76r-vgf3-j6w5 high
October CMS auth bypass and account takeover
Affected range
ECOSYSTEM: introduced 0; fixed 1.0.472ECOSYSTEM: introduced 1.1.1; fixed 1.1.5>=1.1.1,<1.1.5|<1.0.472Fixed versions: 1.0.472, 1.1.5
GHSA-wv23-pfj7-2mjj high
October/System authenticated file write leads to remote code execution
Affected range
ECOSYSTEM: introduced 1.1.0; fixed 1.1.6ECOSYSTEM: introduced 0; fixed 1.0.473<1.0.473|>=1.1.0,<1.1.6Fixed versions: 1.1.6, 1.0.473
GHSA-6gjf-7w99-j7x7 high
Deleted Admin Can Sign In to Admin Interface
Affected range
ECOSYSTEM: introduced 2.1.0; fixed 2.1.12>=2.1.0,<2.1.12Fixed versions: 2.1.12
GHSA-5hfj-r725-wpc4 high
october/system arbitrary code execution
Affected range
ECOSYSTEM: introduced 1.1.0; fixed 1.1.6ECOSYSTEM: introduced 0; fixed 1.0.473<1.0.473|>=1.1.0,<1.1.6Fixed versions: 1.1.6, 1.0.473
GHSA-79jw-2f46-wv22 high
Authenticated remote code execution in October CMS
Affected range
ECOSYSTEM: introduced 0; fixed 1.0.474ECOSYSTEM: introduced 1.1.0; fixed 1.1.10ECOSYSTEM: introduced 2.0.0; fixed 2.1.27>=2.0.0,<2.1.27|>=1.1.0,<1.1.10|<1.0.474Fixed versions: 1.0.474, 1.1.10, 2.1.27
GHSA-x4q7-m6fp-4v9v high
October CMS Safe Mode bypass leads to authenticated Remote Code Execution
Affected range
ECOSYSTEM: introduced 2.0.0; fixed 2.2.34ECOSYSTEM: introduced 3.0.0; fixed 3.0.66>=2.0.0,<2.2.34|>=3.0.0,<3.0.66Fixed versions: 2.2.34, 3.0.66
GHSA-8v7h-cpc2-r8jp high
October CMS upload process vulnerable to RCE via Race Condition
Affected range
ECOSYSTEM: introduced 0; fixed 1.0.476ECOSYSTEM: introduced 1.1.0; fixed 1.1.12ECOSYSTEM: introduced 2.0.0; fixed 2.2.15>=2.0.0,<2.2.15|>=1.1.0,<1.1.12|<1.0.476Fixed versions: 1.0.476, 1.1.12, 2.2.15
GHSA-rvx8-p3xp-fj3p moderate
October CMS stored XSS by authenticated backend user with improper configuration
Affected range
ECOSYSTEM: introduced 3.0.0; fixed 3.5.2>=3.0.0,<3.5.2Fixed versions: 3.5.2
GHSA-j4j5-9x6g-rgxc moderate
October CMS has Stored XSS in Event Log Mail Preview
Affected range
ECOSYSTEM: introduced 4.0.0; fixed 4.1.10ECOSYSTEM: introduced 0; fixed 3.7.14<=3.7.13|>=4.0.0,<=4.1.9Fixed versions: 4.1.10, 3.7.14
GHSA-6qmh-j78v-ffp7 moderate
October CMS has Stored XSS in Backend Editor Markup Classes
Affected range
ECOSYSTEM: introduced 4.0.0; fixed 4.1.10ECOSYSTEM: introduced 0; fixed 3.7.14<=3.7.13|>=4.0.0,<=4.1.9Fixed versions: 4.1.10, 3.7.14
GHSA-3888-q23f-x7qh moderate
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers
Affected range
ECOSYSTEM: introduced 0; fixed 3.7.14ECOSYSTEM: introduced 4.0.0; fixed 4.1.10>=4.0.0,<4.1.10|<3.7.14Fixed versions: 3.7.14, 4.1.10
GHSA-wvpq-h33f-8rp6 moderate
October CMS Vulnerable to Stored XSS via Branding Styles
Affected range
ECOSYSTEM: introduced 0; fixed 3.7.13ECOSYSTEM: introduced 4.0.0; fixed 4.0.12>=4.0.0,<=4.0.11|<=3.7.12Fixed versions: 3.7.13, 4.0.12
GHSA-gxxc-m74c-f48x moderate
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
Affected range
ECOSYSTEM: introduced 0; fixed 3.7.13ECOSYSTEM: introduced 4.0.0; fixed 4.0.12>=4.0.0,<=4.0.11|<=3.7.12Fixed versions: 3.7.13, 4.0.12
GHSA-v73w-r9xg-7cr9 moderate
Use of insecure jQuery version in OctoberCMS
Affected range
ECOSYSTEM: introduced 1.0.319; fixed 1.0.466>=1.0.319,<1.0.466Fixed versions: 1.0.466
GHSA-q22j-5r3g-9hmh moderate
October CMS safe mode bypass using Page template injection
Affected range
ECOSYSTEM: introduced 3.0.0; fixed 3.4.15>=3.0.0,<3.4.15Fixed versions: 3.4.15
GHSA-53m6-44rc-h2q5 moderate
Missing server signature validation in OctoberCMS
Affected range
ECOSYSTEM: introduced 1.1.0; fixed 1.1.11ECOSYSTEM: introduced 0; fixed 1.0.475<1.0.475|>=1.1.0,<1.1.11Fixed versions: 1.1.11, 1.0.475
October CMS: PHP Object Injection via Backend Widget Session Storage
Affected range
ECOSYSTEM: introduced 0; fixed 3.7.17ECOSYSTEM: introduced 4.0.0; fixed 4.2.23>=4.0.0,<4.2.23|<3.7.17Fixed versions: 3.7.17, 4.2.23
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
Affected range
ECOSYSTEM: introduced 0; fixed 3.7.17ECOSYSTEM: introduced 4.0.0; fixed 4.2.23>=4.0.0,<4.2.23|<3.7.17Fixed versions: 3.7.17, 4.2.23
October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
Affected range
ECOSYSTEM: introduced 4.0.0; fixed 4.1.16ECOSYSTEM: introduced 0; fixed 3.7.16<3.7.16|>=4.0.0,<4.1.16Fixed versions: 4.1.16, 3.7.16
October CMS: Reflected XSS via DataTable Form Widget
Affected range
ECOSYSTEM: introduced 0; fixed 3.7.16ECOSYSTEM: introduced 4.0.0>=4.0.0,<4.1.16|<3.7.16Fixed versions: 3.7.16
October CMS Allows Unprotected SVG Rename in Media Manager
Affected range
ECOSYSTEM: introduced 0; fixed 3.7.5<3.7.5Fixed versions: 3.7.5
October System module has a Reflected XSS via X-October-Request-Handler Header
Affected range
ECOSYSTEM: introduced 3.2; fixed 3.5.15>=3.2,<3.5.15Fixed versions: 3.5.15
October System module has an Open Redirect for Administrator Accounts
Affected range
ECOSYSTEM: introduced 3.2; fixed 3.5.15>=3.2,<3.5.15Fixed versions: 3.5.15