Patchfirst
Patchfirst
Chainoctobercms · octoberPackagist:october/cms

octobercms october: fix bypasses (2017–2021)

7 CVEs over 4 generations, 1 Nov 2017 to 14 Jan 2022.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2017-162441 Nov 2017 First in the chain
  2. CVE-2020-1524723 Nov 2020 related to CVE-2017-16244
  3. CVE-2020-1524823 Nov 2020 related to CVE-2017-16244
  4. CVE-2020-2623123 Nov 2020 bypassed the fix for CVE-2020-15247
  5. CVE-2021-212643 May 2021 bypassed the fix for CVE-2020-26231
  6. CVE-2021-3264914 Jan 2022 related to CVE-2020-26231
  7. CVE-2021-3265014 Jan 2022 related to CVE-2020-26231
20172019202020212022 CVE-2020-15247 → CVE-2020-26231: bypassed the fix (high confidence)CVE-2020-26231 → CVE-2021-21264: bypassed the fix (high confidence)CVE-2017-16244 → CVE-2020-15247: related (medium confidence)CVE-2017-16244 → CVE-2020-15248: related (medium confidence)CVE-2020-26231 → CVE-2021-32649: related (medium confidence)CVE-2020-26231 → CVE-2021-32650: related (medium confidence) CVE-2017-16244 1 Nov 2017 CVE-2020-15247 23 Nov 2020 CVE-2020-15248 23 Nov 2020 CVE-2020-26231 23 Nov 2020 CVE-2021-21264 3 May 2021 CVE-2021-32649 14 Jan 2022 CVE-2021-32650 14 Jan 2022 20172019202020212022 CVE-2020-15247 → CVE-2020-26231: bypassed the fix (high confidence)CVE-2020-26231 → CVE-2021-21264: bypassed the fix (high confidence)CVE-2017-16244 → CVE-2020-15247: related (medium confidence)CVE-2017-16244 → CVE-2020-15248: related (medium confidence)CVE-2020-26231 → CVE-2021-32649: related (medium confidence)CVE-2020-26231 → CVE-2021-32650: related (medium confidence) CVE-2017-16244 1 Nov 2017 CVE-2020-15247 23 Nov 2020 CVE-2020-15248 23 Nov 2020 CVE-2020-26231 23 Nov 2020 CVE-2021-21264 3 May 2021 CVE-2021-32649 14 Jan 2022 CVE-2021-32650 14 Jan 2022
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2017-16244 1 Nov 2017 Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for… · fixed in 1.0.427 First in chain 21.1
CVE-2020-15247 23 Nov 2020 Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. · fixed in 1.0.469 CVE-2017-16244 · related · Medium 8.0
CVE-2020-15248 23 Nov 2020 Privilege escalation by backend users assigned to the default "Publisher" system role · fixed in 1.0.470 CVE-2017-16244 · related · Medium 7.6
CVE-2020-26231 23 Nov 2020 Bypass of fix for CVE-2020-15247, Twig sandbox escape · fixed in 1.0.470 CVE-2020-15247 · bypassed the fix · High 8.0
CVE-2021-21264 3 May 2021 Bypass of fix for CVE-2020-26231, Twig sandbox escape · fixed in 1.1.2 CVE-2020-26231 · bypassed the fix · High 7.3
CVE-2021-32649 14 Jan 2022 Authenticated file write leads to remote code execution in october/system · fixed in 1.1.6 CVE-2020-26231 · related · Medium 20.4
CVE-2021-32650 14 Jan 2022 Arbitrary code execution in october/system · fixed in 1.1.6 CVE-2020-26231 · related · Medium 22.5
↑ ↓ chooseEnter openEsc close