CVE-2022-21705: Authenticated remote code execution in octobercms
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safemode / cms.enableSafeMode in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-21705?
CVE-2022-21705 is a vulnerability in Octobercms, a self-hosted CMS platform based on the Laravel PHP Framework.
What is the severity of CVE-2022-21705?
The severity of CVE-2022-21705 is high with a CVSS score of 7.2.
How does CVE-2022-21705 affect Octobercms?
CVE-2022-21705 affects user input sanitization in Octobercms, allowing an authenticated user to bypass certain security measures.
How can an authenticated user exploit CVE-2022-21705?
An authenticated user with the permissions to create, modify, and delete website pages can exploit CVE-2022-21705 in Octobercms.
Is there a fix available for CVE-2022-21705?
Yes, a fix for CVE-2022-21705 is available. It is recommended to update to a patched version of Octobercms.