CVE-2020-15246CWE-863

Local File Inclusion by unauthenticated users

High · published November 23, 2020

CVSS v3.1
7.5
EPSS
2%
Percentile
77.0
In the wild
Unconfirmed
What it is

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an attacker can read local files on an October CMS server via a specially crafted request. Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01699 · 77.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2020-11-23T19:25Z
EPSS history
Timeline
  • 23 NOV 19:25Z
    Local File Inclusion by unauthenticated users
    cvelistv5