UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15128

Encrypted cookie values are not tied to the cookie name

Severity
Medium 6.3
Published
30 Jul 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.468
Also known as
GHSA-55mm-5399-7r63
Sources
NVD, Project advisories (GitHub)

Description

In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your usage exposed a way for users to provide…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • Every version before 1.0.468
October CMSServers and applications · github:octobercms/october
  • From 1.0.319 before 1.0.468

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15128
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15128
  • GitHub Advisory Database https://github.com/advisories/GHSA-55mm-5399-7r63
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-55mm-5399-7r63