CVE-2020-15246: Local File Inclusion by unauthenticated users
Published Nov 23, 2020
·Updated
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an attacker can read local files on an October CMS server via a specially crafted request. Issue has been patched in Build 469 (v1.0.469) and v1.1.0.
Affected Software
1 affected component
October CMS Debugbar>=1.0.421<1.0.469
Remediation
Event History
Nov 23, 2020
CVE Published
via MITRE·07:25 PM
Data Sourced
via MITRE·07:25 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2020-15246?
CVE-2020-15246 is a vulnerability in October CMS that allows an attacker to read local files on the server.
2
How does CVE-2020-15246 affect October CMS?
CVE-2020-15246 affects October CMS versions 1.0.421 and before 1.0.469.
3
What is the severity of CVE-2020-15246?
The severity of CVE-2020-15246 is high with a CVSS score of 7.5.
4
Has CVE-2020-15246 been patched?
Yes, CVE-2020-15246 has been patched in Build 469 (v1.0.469) of October CMS.
5
How can I fix CVE-2020-15246 in my October CMS installation?
To fix CVE-2020-15246, update your October CMS installation to at least version 1.0.469.