CVE-2020-5295 Public exploit Medium · 4.8 EPSS 7.4%

Local File read vulnerability in OctoberCMS

octobercms · october

Official description · CVE.org

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Breakdown

27.2 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

What they do
- Read files and data on the systemT1005 · Data from Local SystemSource data14 general detection rules

Public exploit code (Exploit-DB) appeared 5 months after disclosure. No confirmed exploitation is recorded.

Disclosed3 Jun 2020day 0
Public exploit codeExploit-DB13 Nov 2020+5 mo

techniques

1 , grouped by in kill-chain order 1

CollectionTA0009

Data from Local System T1005

MITRE CTID mapping of the CVE · primary impact

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

External Remote ServicesT1133 needs user interaction; not a public-facing exploit

Detection

0 rules for this CVE · 14 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-5295 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Data from Local SystemT100514 general rules

OpenCanary - SMB File Open Requesthightest
Potential Conti Ransomware Database Dumping Activity Via SQLCmdhightest
SQLite Chromium Profile Data DB Accesshightest
SQLite Firefox Profile Data DB Accesshightest
VeeamBackup Database Credentials Dump Via Sqlcmd.EXEhightest
Script Interpreter Spawning Credential Scanner - Linuxhighexperimental
Script Interpreter Spawning Credential Scanner - Windowshighexperimental
Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental

All 14 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: october/cms.

Packagistoctober/cmsGHSA-r23f-c2j5-rx2f

Upgrade to 1.0.466 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2017-1000119, CVE-2020-5297).

Set the version to 1.0.466 or later in your composer.json.

The first fix for CVE-2020-5295.

Affected versions

If you run	Upgrade to
1.0.319 up to 1.0.466	1.0.466

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2020-0511

October CMS Build 465 - Arbitrary File Read Exploit (Authenticated)EDB-49045 · webapps · php · 2020-11-13

, 30 Oct 2026

7.4%Top 5.6%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 94.4%).

3.1

4.8Medium · 4.8

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9441 18.9/20

Threat reports0 reports 0.0/10

Public exploit code1 Exploit-DB entry; 1 NVD exploit link 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 4.8 3.4/7

End-of-life productsupported or unknown 0.0

Total27.2

Record

Published: 3 Jun 2020
Modified: 4 Aug 2024
: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

CollectionTA0009

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

References

x_refsource_CONFIRM 1

x_refsource_MISC 2

mailing-list 1

What they do

techniques