CVE-2017-16941
Last modified
CVE-2017-16941 is a vulnerability of currently unknown severity. October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says "I don't think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering.. EPSS estimates a 1.56% chance of exploitation in the next 30 days.
Description
October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says "I don't think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Octobercms | October | <= 1.0.428 |
References
- https://github.com/octobercms/october/issues/3257Issue Tracking, Third Party Advisory
- https://github.com/octobercms/october/issues/3257Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-16941?
How severe is CVE-2017-16941?
How do I fix CVE-2017-16941?
Are you affected by CVE-2017-16941?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST