CVE-2018-1999009

October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.
References
Link Resource
http://octobercms.com/support/article/rn-10 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:octobercms:october:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-07-23 15:29

Updated : 2024-02-04 20:03


NVD link : CVE-2018-1999009

Mitre link : CVE-2018-1999009

CVE.ORG link : CVE-2018-1999009


JSON object : View

Products Affected

octobercms

  • october
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor