CVE-2020-5297

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-73 CWE-610

Affected software

Vendor	Product	Versions
octobercms	october	>= 1.0.319, < 1.0.466

References

http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Aug/2Exploit, Mailing List, Third Party Advisory
https://github.com/octobercms/october/commit/6711dae8ef70caf0e94cec434498012a2ccd86b8Patch, Third Party Advisory
https://github.com/octobercms/october/security/advisories/GHSA-9722-rr68-rfpgPatch, Third Party Advisory
http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Aug/2Exploit, Mailing List, Third Party Advisory
https://github.com/octobercms/october/commit/6711dae8ef70caf0e94cec434498012a2ccd86b8Patch, Third Party Advisory
https://github.com/octobercms/october/security/advisories/GHSA-9722-rr68-rfpgPatch, Third Party Advisory

Timeline

Published: Jun 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-52984.8In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functio CVE-2020-52995.1In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data tha CVE-2020-53005.3In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client au CVE-2020-53013.1SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in `SimpleSAML\Module` that proc CVE-2020-53026.5MH-WikiBot (an IRC Bot for interacting with the Miraheze API), had a bug that allowed any unprivileged user to access the steward commands o CVE-2020-53033.7Tendermint before versions 0.33.3, 0.32.10, and 0.31.12 has a denial-of-service vulnerability. Tendermint does not limit the number of P2P c CVE-2020-53047.5The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in CVE-2020-53054.8Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.CVE-2020-53064.8Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.CVE-2020-53079.8PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the CVE-2020-53086.1PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-ca CVE-2020-53108.8libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.