NVD Vulnerability Detail

CVE-2020-15248

Summary	October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. Issue has been patched in Build 470 (v1.0.470) & v1.1.1.
Publication Date	Nov. 24, 2020, 5:15 a.m.
Registration Date	Jan. 26, 2021, 11:53 a.m.
Last Update	Nov. 21, 2024, 2:05 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:octobercms:october::::::::		1.0.319			1.0.469

Related information, measures and tools

No	URL	タグ
1	https://github.com/octobercms/october/commit/78a37298a4ed4602b383522344a31e311402d829	Patch Third Party Advisory
2	https://github.com/octobercms/october/commit/78a37298a4ed4602b383522344a31e311402d829	Patch Third Party Advisory
3	https://github.com/octobercms/october/security/advisories/GHSA-rfjc-xrmf-5vvw	Third Party Advisory
4	https://github.com/octobercms/october/security/advisories/GHSA-rfjc-xrmf-5vvw	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-269	不適切な権限管理	https://cwe.mitre.org/data/definitions/269.html

JVN Vulnerability Information

October CMS における不正な認証に関する脆弱性

Title	October CMS における不正な認証に関する脆弱性
Summary	October CMS には、不正な認証に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 11, 2020, midnight
Registration Date	July 7, 2021, 4:06 p.m.
Last Update	July 7, 2021, 4:06 p.m.

Affected System

OctoberCMS

October 1.0.319 以上 1.0.470 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-15248	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15248
National Vulnerability Database (NVD)
2	CVE-2020-15248	https://nvd.nist.gov/vuln/detail/CVE-2020-15248

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-863	https://cwe.mitre.org/data/definitions/863.html

ベンダー情報

No	Name	URL
GitHub
1	Privilege escalation by backend users assigned to the default "Publisher" system role	https://github.com/octobercms/october/security/advisories/GHSA-rfjc-xrmf-5vvw
2	Tightened up the default permissions granted to the "Publisher" system role out of the box	https://github.com/octobercms/october/commit/78a37298a4ed4602b383522344a31e311402d829

Change Log

No	Changed Details	Date of change
1	[2021年07月07日] 掲載	July 7, 2021, 4:06 p.m.