CVE-2017-16941

** DISPUTED ** October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says "I don't think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering."

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/octobercms/october/issues/3257	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-11-25 05:29

Updated : 2024-08-05 21:15

NVD link : CVE-2017-16941

Mitre link : CVE-2017-16941

CVE.ORG link : CVE-2017-16941

JSON object : View

Products Affected

octobercms

october

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2017-16941", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2017-11-25T05:29:00.210", "references": [{"url": "https://github.com/octobercms/october/issues/3257", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says \"I don't think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering."}, {"lang": "es", "value": "** EN DISPUTA ** October CMS hasta la versi\u00f3n 1.0.428 no evita el uso de .htaccess en los temas, lo que permite que usuarios autenticados remotos ejecuten c\u00f3digo PHP arbitrario mediante la descarga de un archivo ZIP de temas de /backend/cms/themes y, a continuaci\u00f3n, subiendo e importando un archivo modificado con dos nuevos archivos: un archivo .php y un archivo .htaccess. NOTA: el fabricante dice: \"No creo que [un atacante capaz de iniciar sesi\u00f3n en el sistema bajo una cuenta que tiene acceso para gestionar/subir temas] sea un modelo de amenaza que necesitemos tener en consideraci\u00f3n\"."}], "lastModified": "2024-08-05T21:15:29.760", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90A9C91F-B238-4D53-B638-63A977A99FE4", "versionEndIncluding": "1.0.428"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}