GHSA-xwjr-6fj7-fc6hHighCVSS 7.5

Local File Inclusion by unauthenticated users

Published
November 23, 2020
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-15246 →

📋 Description

Impact

An attacker can exploit this vulnerability to read local files on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request.

Patches

Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

Workarounds

Apply https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469.

References

Reported by ka1n4t

For more information

If you have any questions or comments about this advisory:

Threat assessment:

🎯 Affected products1

  • composer/october/cms:>= 1.0.421, < 1.0.469

🔗 References (4)