Lookup for vulnerable packages by Package URL.
| Purl | pkg:composer/october/october@2.0.0 |
| Type | composer |
| Namespace | october |
| Name | october |
| Version | 2.0.0 |
| Qualifiers |
|
| Subpath | |
| Is_vulnerable | true |
| Next_non_vulnerable_version | 4.1.17 |
| Latest_non_vulnerable_version | 4.1.17 |
| Affected_by_vulnerabilities |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
| url |
VCID-r8fq-h2st-zuba |
| vulnerability_id |
VCID-r8fq-h2st-zuba |
| summary |
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2022-21705, GHSA-79jw-2f46-wv22
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r8fq-h2st-zuba |
|
| 6 |
| url |
VCID-swte-fwyb-yfbz |
| vulnerability_id |
VCID-swte-fwyb-yfbz |
| summary |
Improper Authentication
October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2021-41126, GHSA-6gjf-7w99-j7x7
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-swte-fwyb-yfbz |
|
|
| Fixing_vulnerabilities |
|
| Risk_score | 4.0 |
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:composer/october/october@2.0.0 |