CVE-2022-35944

October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (`cms.safe_mode`) restriction to introduce new PHP code in a CMS template using a specially crafted request. The issue has been patched in versions 2.2.34 and 3.0.66.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v	Third Party Advisory
https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:octobercms:october::::::::
	cpe:2.3:a:octobercms:october::::::::

History

21 Nov 2024, 07:12

Type	Values Removed	Values Added
References	~~() https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v - Third Party Advisory~~	() https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v - Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~7.2~~	v2 : unknown v3 : 6.2

Information

Published : 2022-10-13 22:15

Updated : 2024-11-21 07:12

NVD link : CVE-2022-35944

Mitre link : CVE-2022-35944

CVE.ORG link : CVE-2022-35944

JSON object : View

Products Affected

octobercms

october

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2022-35944", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 0.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2022-10-13T22:15:10.217", "references": [{"url": "https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the \"Editor\" section, they can bypass the Safe Mode (`cms.safe_mode`) restriction to introduce new PHP code in a CMS template using a specially crafted request. The issue has been patched in versions 2.2.34 and 3.0.66."}, {"lang": "es", "value": "October es una plataforma de Sistema de Administraci\u00f3n de Contenidos (CMS) auto alojada basada en el Framework PHP Laravel. Esta vulnerabilidad s\u00f3lo afecta a las instalaciones que son basadas en la restricci\u00f3n del modo seguro, com\u00fanmente usado cuando es proporcionado acceso p\u00fablico al panel de administraci\u00f3n. Asumiendo que un atacante presenta acceso al panel de administraci\u00f3n y permiso para abrir la secci\u00f3n \"Editor\", puede omitirse la restricci\u00f3n de modo seguro (\"cms.safe_mode\") para introducir nuevo c\u00f3digo PHP en una plantilla del CMS usando una petici\u00f3n especialmente dise\u00f1ada. El problema ha sido parcheado en versiones 2.2.34 y 3.0.66"}], "lastModified": "2024-11-21T07:12:01.253", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B37B291-6585-4871-992E-1206461FA7B3", "versionEndExcluding": "2.2.34"}, {"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03BB2ACB-3BFD-4560-84DF-3A2835E79ADB", "versionEndExcluding": "3.0.66", "versionStartIncluding": "3.0.00"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}