p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in october/system · Seite 2

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für october/system: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 25

  1. CVE-2021-32650

    Hoch · CVSS 8.8EPSS 2,09%Korrektur verfügbar

    Arbitrary code execution in october/system

    October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

    october/system october/systemPHP
    • Auf 1.0.473 aktualisieren
    • Auf 1.1.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2021-41126

    Hoch · CVSS 7.2EPSS 1,09%Korrektur verfügbar

    Deleted Admin Can Sign In to Admin Interface

    October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.

    october/systemPHP
    • Auf 2.1.12 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2021-29487

    Hoch · CVSS 7.4EPSS 0,9%Korrektur verfügbar

    Authentication bypass in Octobercms

    octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability to bypass authentication and takeover of and user account on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability. The issue has been patched in Build 472 and v1.1.5.

    october/system october/systemPHP
    • Auf 1.0.472 aktualisieren
    • Auf 1.1.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2021-32648

    Hoch · CVSS 8.2EPSS 90,42%Im KEV-KatalogÖffentlicher ExploitKorrektur verfügbar

    Account Takeover in Octobercms

    octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

    october/system october/systemPHP
    • Auf 1.0.472 aktualisieren
    • Auf 1.1.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. GHSA-v73w-r9xg-7cr9

    Nicht bewertetKorrektur verfügbar

    Use of insecure jQuery version in OctoberCMS

    ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. ### Patches Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery. ### Workarounds Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466. ### References - https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022 - https://jquery.com/upgrad

    october/systemPHP
    • Auf 1.0.466 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →