by Kastro
Paper/Archive/CVE-2023-44382

CVE-2023-44382

octobercms october — October CMS safe mode bypass using Twig sandbox escape

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 58.9.589 × 2011.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to `cms.safe_mode` being enabled can write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This issue has been patched in 3.4.15.

Affected

ProductAffectedFixed inSource
october>= 3.0.0, < 3.4.15–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refgithub.com/octobercms/october/security/advisories/GHSA-p8q3-h652-65vx