Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2020-15246

Good to know:

icon

Date: November 23, 2020

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an attacker can read local files on an October CMS server via a specially crafted request. Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

Language: PHP

Severity Score

Related Resources (5)

https://github.com/octobercms/october
https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4
https://nvd.nist.gov/vuln/detail/CVE-2020-15246
https://github.com/octobercms/october/security/advisories/GHSA-xwjr-6fj7-fc6h
https://www.mend.io/vulnerability-database/CVE-2020-15246

Severity Score

Weakness Type (CWE)

Path Traversal

CWE-22

Incorrect Authorization

CWE-863

Top Fix

icon

Upgrade Version

Upgrade to version 1.0.469

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us