Reliance on Cookies without validation in OctoberCMS
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-327.
Summary
In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. Issue has been fixed in build 468 (v1.0.468).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| October CMS | october | before 1.0.468 | 1.0.468 | Patch available | CNA |
| — | october/rain (Packagist) | 1.0.319 to before 1.0.468 | 1.0.468 | Patch available | GHSA-55mm-5399-7r63 |
- october VendorOctober CMS Affected before 1.0.468 Fixed in 1.0.468 Patch available CNA
- october/rain (Packagist) Vendor— Affected 1.0.319 to before 1.0.468 Fixed in 1.0.468 Patch available GHSA-55mm-5399-7r63
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* | before 1.0.468 | Vulnerable | October CMS |
- cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* Versions before 1.0.468 Vulnerable ·October CMS
Remediation
- Fix · CNA october (octobercms) Fixed in 1.0.468
- Fix · GHSA-55mm-5399-7r63 october/rain (Packagist) Fixed in 1.0.468 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15128
- 2026-10-03 Alias added: GHSA-55mm-5399-7r63
References
More October CMS October vulnerabilities
- TI-2021-12316 Account Takeover in Octobercms KEVCVSS 3.1CRITICAL 9.1
- TI-2021-12318 Arbitrary code execution in october/system CVSS 3.1HIGH 8.8
- TI-2017-14456 October CMS build 412 is vulnerable to PHP code execution in the file upload… CVSS 3.0HIGH 7.2
- TI-2023-23545 A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an… CVSS 3.1MEDIUM 5.4
- TI-2023-19223 An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute… CVSS 3.1MEDIUM 5.4
- TI-2024-30847 October 3.6.30 allows an authenticated admin account to upload a PDF file containing… CVSS 3.1MEDIUM 4.7
Sources
- CVE-2020-15128 · CVE Program
- CVE-2020-15128 · NVD
- FIRST EPSS
- GHSA-55mm-5399-7r63 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences