CVE-2020-15128— Reliance on Cookies without validation in OctoberCMS
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-15128
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Reliance on Cookies without validation in OctoberCMS
Source: NVD (National Vulnerability Database)
Vulnerability Description
In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. Issue has been fixed in build 468 (v1.0.468).
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在信任Cookie未进行验证与完整性检查
Source: NVD (National Vulnerability Database)
Vulnerability Title
October CMS 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
October CMS是一套基于PHP和Laravel Web应用程序框架的开源内容管理系统（CMS）。 OctoberCMS 1.0.468之前版本中存在安全漏洞，该漏洞源于程序没有将加密的cookie值绑定到该值的cookie名上。攻击者可利用该漏洞获取敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| octobercms | october | < 1.0.468 | - |
II. Public POCs for CVE-2020-15128
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-15128
请登录查看更多情报信息。
- https://github.com/octobercms/library/pull/508x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2020-15128
IV. Related Vulnerabilities
Same product: october
- CVE-2026-29179
October: Editor Sub-Permission Bypass for Asset and Blueprin - CVE-2026-27937
October: Reflected XSS via DataTable Form Widget - CVE-2026-26274
October: Safe Mode Bypass via Twig Database Write Operations - CVE-2026-26067
October: Safe Mode Bypass via CSS Preprocessor Compilers - CVE-2026-25133
October CMS has Stored XSS via SVG Filter Bypass
Same vendor: octobercms
- CVE-2026-29179
October: Editor Sub-Permission Bypass for Asset and Blueprin - CVE-2026-27937
October: Reflected XSS via DataTable Form Widget - CVE-2026-26274
October: Safe Mode Bypass via Twig Database Write Operations - CVE-2026-26067
October: Safe Mode Bypass via CSS Preprocessor Compilers - CVE-2026-25133
October CMS has Stored XSS via SVG Filter Bypass
Same weakness: CWE-565
- CVE-2026-39963
Serendipity: Host Header Injection enables authentication co - CVE-2026-5130
Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privile - CVE-2014-125112
Plack::Middleware::Session::Cookie versions through 0.21 for - CVE-2022-50926
WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation - CVE-2025-14440
JAY Login & Register <= 2.4.01 - Authentication Bypass via C
V. Comments for CVE-2020-15128
No comments yet