CVE-2022-35944

CVSS V2 None CVSS V3 High 7.2
Description
October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (`cms.safe_mode`) restriction to introduce new PHP code in a CMS template using a specially crafted request. The issue has been patched in versions 2.2.34 and 3.0.66.
Overview
  • CVE ID
  • CVE-2022-35944
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2022-10-13T22:15:10
  • Last Modified Date
  • 2022-10-18T20:32:33
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* 1 OR 2.2.34
cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* 1 OR 3.0.00 3.0.66
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • HIGH
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 7.2
  • Base Severity
  • HIGH
  • Exploitability Score
  • 1.2
  • Impact Score
  • 5.9
History
Created Old Value New Value Data Type Notes
2022-10-13 23:00:07 Added to TrackCVE
2022-12-07 07:06:39 2022-10-13T22:15Z 2022-10-13T22:15:10 CVE Published Date updated
2022-12-07 07:06:39 2022-10-18T20:32:33 CVE Modified Date updated
2022-12-07 07:06:39 Analyzed Vulnerability Status updated