Summaryinfo

A vulnerability was found in October CMS up to 1.0.469/1.1.0. It has been classified as critical. This affects an unknown part of the component Twig Sandbox. The manipulation leads to authorization. This vulnerability is uniquely identified as CVE-2020-26231. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Detailsinfo

A vulnerability was found in October CMS up to 1.0.469/1.1.0 (Content Management System) and classified as critical. Affected by this issue is some unknown processing of the component Twig Sandbox. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability.

The weakness was published 11/24/2020. The advisory is available at github.com. This vulnerability is handled as CVE-2020-26231. The technical details are unknown and an exploit is not available.

Upgrading to version 1.0.470 or 1.1.1 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Vendor

• October

Name

• CMS

Version

• 1.0
• 1.0.469
• 1.1.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion