Skip to content

Arbitrary Upload of Whitelisted File Types by authenticated backend user with cms.manage_assets permission

Low
LukeTowers published GHSA-9722-rr68-rfpg Jun 2, 2020

Package

composer october/cms (Composer)

Affected versions

>= 1.0.319, < 1.0.466

Patched versions

1.0.466

Description

Impact

An attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the cms.manage_assets permission.

Patches

Issue has been patched in Build 466 (v1.0.466).

Workarounds

Apply 6711dae to your installation manually if unable to upgrade to Build 466.

References

Reported by Sivanesh Ashok

For more information

If you have any questions or comments about this advisory:

Threat assessment:

Screen Shot 2020-03-31 at 12 21 10 PM

Severity

Low

CVE ID

CVE-2020-5297

Weaknesses

No CWEs

Credits