CVE-2021-32649

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*
cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*

History

05 Aug 2022, 11:31

Type Values Removed Values Added
CWE CWE-74 CWE-94

25 Jan 2022, 16:13

Type Values Removed Values Added
References (MISC) https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 - (MISC) https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 - Patch, Third Party Advisory
References (CONFIRM) https://github.com/octobercms/october/security/advisories/GHSA-wv23-pfj7-2mjj - (CONFIRM) https://github.com/octobercms/october/security/advisories/GHSA-wv23-pfj7-2mjj - Patch, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 6.5
v3 : 8.8
CWE CWE-74
CPE cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*

14 Jan 2022, 15:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-01-14 15:15

Updated : 2024-02-04 22:08


NVD link : CVE-2021-32649

Mitre link : CVE-2021-32649

CVE.ORG link : CVE-2021-32649


JSON object : View

Products Affected

octobercms

  • october
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')