CVE-2022-23655: Missing server signature validation in OctoberCMS
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to build 474 or v1.1.10. The only known workaround is to manually apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) which adds server signature validation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-23655?
CVE-2022-23655 is a vulnerability in OctoberCMS that allows non-authoritative gateway servers to be used to exfiltrate user private keys.
What is the severity of CVE-2022-23655?
The severity of CVE-2022-23655 is medium, with a severity score of 5.3.
How does CVE-2022-23655 affect OctoberCMS?
CVE-2022-23655 affects OctoberCMS by not validating gateway server signatures, allowing non-authoritative servers to be used for exfiltration of user private keys.
How can I fix CVE-2022-23655?
To fix CVE-2022-23655, users are advised to upgrade their OctoberCMS installations to version 1.1.11 or later.
Where can I find more information about CVE-2022-23655?
You can find more information about CVE-2022-23655 on the GitHub page of OctoberCMS and the related security advisories.