Description
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
References (4)
Core 4
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc
Patch, Third Party Advisory x_refsource_confirm
https://github.com/octobercms/october/security/advisories/GHSA-jv6v-fvvx-4932
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/Aug/2
Scores
CVSS v3
6.2
EPSS
0.0143
EPSS Percentile
69.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N
Details
CWE
CWE-610
CWE-73
Status
published
Products (2)
october/cms
1.0.319 - 1.0.466Packagist
octobercms/october
1.0.319 - 1.0.466
Published
Jun 03, 2020
Tracked Since
Feb 18, 2026