CVE-2020-5296mediumCWE-73

CVE-2020-5296: fallo de gravedad media en octobercms october

Arbitrary File Deletion vulnerability in OctoberCMS

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear October CMS+ Monitorear october/cms

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.2epss 1.4%
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N
Productos afectados
octobercms · october
CVEs relacionadas — octobercms october

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-32648HIGHAccount Takeover in OctobercmsEPSS 91.2%KEVCVE-2022-21705HIGHAuthenticated remote code execution in octobercmsEPSS 8.6%CVE-2020-5295MEDIUMLocal File read vulnerability in OctoberCMSEPSS 7.4%CVE-2021-32650HIGHArbitrary code execution in october/systemEPSS 2.2%CVE-2021-21265MEDIUMOctober CMS vulnerable to Potential Host Header Poisoning on misconfigured serversEPSS 1.7%CVE-2020-15246HIGHLocal File Inclusion by unauthenticated usersEPSS 1.7%