CVE-2023-44382
Critical
Description
October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to `cms.safe_mode` being enabled can write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This issue has been patched in 3.4.15.
SeverityCritical
CVSS9.1
Exploit probability—
ProductOctober
PublishedDec 1, 2023
First seenDec 1, 2023
Weakness typeCWE-94Code injection
How to fix
Update
- octobercms october3.4.15 or later
- october/system3.4.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| octobercms october | 3.0.0 ≤ v < 3.4.15 | 3.4.15 |
| october/systemPackagist | 3.0.0 ≤ v < 3.4.15 | 3.4.15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.