Detections
Analytics
SCA: security update for october/rain (GHSA-55mm-5399-7r63)
medium Tenable Cloud Security Plugin ID 410594
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the
value belonged to. This meant that certain classes of attacks that took advantage of other theoretical
vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance
of succeeding. Specifically, if your usage exposed a way for users to provide unfiltered user input and
have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie)
they could then use the generated cookie in place of other more tightly controlled cookies; or if your
usage exposed the plaintext version of an encrypted cookie at any point to the user they could
theoretically provide encrypted content from your application back to it as an encrypted cookie and force
the framework to decrypt it for them. Issue has been fixed in build 468 (v1.0.468). (CVE-2020-15128)
See Also
Plugin Details
Severity: Medium
ID: 410594
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3.3
Percentile: 50.87
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Low
Base Score: 3.5
Temporal Score: 2.6
Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS Score Source: CVE-2020-15128
CVSS v3
Risk Factor: Medium
Base Score: 6.3
Temporal Score: 5.5
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/5/2020
Vulnerability Publication Date: 7/31/2020
Reference Information
CVE: CVE-2020-15128