{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-44382", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-09-28T17:56:32.612Z", "datePublished": "2023-12-01T21:48:41.764Z", "dateUpdated": "2024-08-02T20:07:33.274Z"}, "containers": {"cna": {"title": "October CMS safe mode bypass using Twig sandbox escape", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/octobercms/october/security/advisories/GHSA-p8q3-h652-65vx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/octobercms/october/security/advisories/GHSA-p8q3-h652-65vx"}], "affected": [{"vendor": "octobercms", "product": "october", "versions": [{"version": ">= 3.0.0, < 3.4.15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-01T21:48:41.764Z"}, "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to `cms.safe_mode` being enabled can write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This issue has been patched in 3.4.15."}], "source": {"advisory": "GHSA-p8q3-h652-65vx", "discovery": "UNKNOWN"}, "x_gcve": [{"vulnId": "CVE-2023-44382", "recordType": "advisory"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:07:33.274Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/octobercms/october/security/advisories/GHSA-p8q3-h652-65vx", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/octobercms/october/security/advisories/GHSA-p8q3-h652-65vx"}]}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2023-44382", "date": "2026-10-23", "epss": "0.00873", "percentile": "0.58528"}, "nvd": "{\"cve\":{\"id\":\"CVE-2023-44382\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-12-01T22:15:09.780\",\"lastModified\":\"2026-06-17T06:27:31.820\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to `cms.safe_mode` being enabled can write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This issue has been patched in 3.4.15.\"},{\"lang\":\"es\",\"value\":\"October es Content Management System (CMS) y una plataforma web para ayudar con el flujo de trabajo de desarrollo. Un usuario backend autenticado con los permisos `editor.cms_pages`, `editor.cms_layouts` o `editor.cms_partials` a quien normalmente no se le permitir\u00eda proporcionar c\u00f3digo PHP para que lo ejecute el CMS debido a que `cms.safe_mode` est\u00e1 habilitado puede escribir c\u00f3digo Twig espec\u00edfico para escapar de la sandbox de Twig y ejecutar PHP arbitrario. Este problema se solucion\u00f3 en 3.4.15.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"octobercms\",\"product\":\"october\",\"versions\":[{\"version\":\">= 3.0.0, < 3.4.15\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.4.15\",\"matchCriteriaId\":\"19EF8091-8849-4A30-831A-E158A085871B\"}]}]}],\"references\":[{\"url\":\"https://github.com/octobercms/october/security/advisories/GHSA-p8q3-h652-65vx\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/octobercms/october/security/advisories/GHSA-p8q3-h652-65vx\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}", "redhat_vex": {"current_release_date": "2025-05-29T00:52:43+00:00", "cve": "CVE-2023-44382", "id": "CVE-2023-44382", "initial_release_date": "2023-01-01T00:00:00+00:00", "product_status:known_not_affected": "1", "source": "Red Hat CSAF VEX", "status": "final", "title": "October CMS safe mode bypass using Twig sandbox escape", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-44382.json", "version": "3"}}}