Detections
Analytics

SCA: security update for october/cms (GHSA-fcr8-6q7r-m4wg)

medium Tenable Cloud Security Plugin ID 414453

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of
 CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was discovered that has the same impact as CVE-2020-26231
 & CVE-2020-15247. An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or
 `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be
 executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to
 escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their
 users with those permissions to normally write & manage PHP within the CMS by not having
 `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure
 that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue
 has been patched in Build 472 (v1.0.472) and v1.1.2. As a workaround, apply
 https://github.com/octobercms/october/commit/f63519ff1e8d375df30deba63156a2fc97aa9ee7 to your installation
 manually if unable to upgrade to Build 472 or v1.1.2. (CVE-2021-21264)

See Also

https://github.com/advisories/GHSA-fcr8-6q7r-m4wg

Plugin Details

Severity: Medium

ID: 414453

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.1

Percentile: 49.34

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Temporal Score: 3.3

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-21264

CVSS v3

Risk Factor: Medium

Base Score: 5.2

Temporal Score: 4.5

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/4/2021

Vulnerability Publication Date: 5/3/2021

Reference Information

CVE: CVE-2021-21264

cwe: CWE-862