CVE-2017-1000195

October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2017-11-17

Last modified

2024-09-16

Weaknesses

CWE-502

Affected products

• October (Octobercms)

References

• https://github.com/octobercms/october/compare/v1.0.412...v1.0.413#diff-c328b7b99eac0d17b3c71eb37038fd61R317