CVE-2020-5297 Public exploit Low · 3.4 EPSS 1.2%

Upload whitelisted files to any directory in OctoberCMS

octobercms · october

Official description · CVE.org

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Breakdown

20.9 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

What they do
- Plant a web shell for remote controlT1505.003 · Web ShellSource data35 general detection rules
What can follow
- Run commands on the systemT1059 · Command and Scripting InterpreterSource data95 general detection rules

Disclosed on 3 Jun 2020. No public exploit code or confirmed exploitation is recorded.

techniques

2 , grouped by in kill-chain order 2

ExecutionTA0002

Command and Scripting Interpreter T1059

MITRE CTID mapping of the CVE · follow-on activity

PersistenceTA0003

Web Shell T1505.003

MITRE CTID mapping of the CVE · primary impact

Detection

0 rules for this CVE · 130 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-5297 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Web ShellT1505.00335 general rules

Certificate Request Export to Exchange Webservercriticaltest
CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploitcriticaltest
Mailbox Export to Exchange Webservercriticaltest
Oracle WebLogic Exploitcriticaltest
Solarwinds SUPERNOVA Webshell Accesscriticaltest
Webshell Remote Command Executioncriticaltest
WordPress Wp2shell Webshell Plugin Accesscriticalexperimental
Antivirus - Web Shell Detection Signaturehightest

All 35 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: october/cms.

Packagistoctober/cmsGHSA-9722-rr68-rfpg

Upgrade to 1.0.466 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2017-1000119, CVE-2020-5295).

Set the version to 1.0.466 or later in your composer.json.

The first fix for CVE-2020-5297.

Affected versions

If you run	Upgrade to
1.0.319 up to 1.0.466	1.0.466

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2020-0474

Public exploitAdvisories link exploit code.

, 30 Oct 2026

1.2%Top 32%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 67.7%).

3.1

3.4Low · 3.4

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.6768 13.5/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD exploit link 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 3.4 2.4/7

End-of-life productsupported or unknown 0.0

Total20.9

Record

Published: 3 Jun 2020
Modified: 4 Aug 2024
: CWE-73 External Control of File Name or Path
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1What they do

2What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

ExecutionTA0002

PersistenceTA0003

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

References

x_refsource_CONFIRM 1

x_refsource_MISC 2

mailing-list 1

What they do

What can follow

techniques