{"items":[{"id":"NVI-00003133","kind":"vulnerability","title":"Reliance on Cookies without validation in OctoberCMS","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-55mm-5399-7r63","CVE-2020-15128"],"plain_summary":"OSV carries this publisher advisory for october/rain. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.0.468 for october/rain. Confirm the publisher’s latest guidance.","source_ids":["sr-33b98fa6ed8dba7c3aba3fb82a0b9698"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-25f6fc094371ede3f615bf2147c7410d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T02:56:06.357Z","value":"3.5 LOW (2.0)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-9cbd9edec9f35f8d638b596da50c998c"},{"kind":"CVSS","as_of":"2026-06-17T02:56:06.357Z","value":"6.1 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-9cbd9edec9f35f8d638b596da50c998c"},{"kind":"CVSS","as_of":"2026-06-17T02:56:06.357Z","value":"6.3 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-9cbd9edec9f35f8d638b596da50c998c"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.689%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.52782. Missing scores are unknown.","source_id":"sr-25f6fc094371ede3f615bf2147c7410d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-33b98fa6ed8dba7c3aba3fb82a0b9698","url":"https://github.com/advisories/GHSA-55mm-5399-7r63","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-55mm-5399-7r63","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.677Z"},{"id":"sr-9cbd9edec9f35f8d638b596da50c998c","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15128","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2020-15128","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T22:07:06.394Z"},{"id":"sr-25f6fc094371ede3f615bf2147c7410d","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2020-15128","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:27:48.610Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-33b98fa6ed8dba7c3aba3fb82a0b9698"],"technology":"october/rain","known_exclusions":[],"conditions_summary":"### Impact\nPreviously encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. \n\nSpecifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. \n\n### Patches\nIssue has been patched in Build 468 (v1.0.468).\n\n>**NOTE**: If you are using the cookie session driver, all of your session data will be invalidated. All other session drivers should smoothly upgrade to the changes (although the backend authentication persist cookie will also be invalidated requiring users to login again once their cur","public_affected_ranges":["ECOSYSTEM: introduced 1.0.319; fixed 1.0.468"]}],"null_published_at":"2026-11-06T15:18:11.419Z","source_updated_at":"2026-09-10T03:48:31.648Z","source_disclosed_at":"2020-08-05T14:52:54.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:49.677Z"},{"id":"NVI-00003133","kind":"vulnerability","title":"Reliance on Cookies without validation in OctoberCMS","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-55mm-5399-7r63","CVE-2020-15128"],"plain_summary":"OSV carries this publisher advisory for october/rain. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.0.468 for october/rain. Confirm the publisher’s latest guidance.","source_ids":["sr-33b98fa6ed8dba7c3aba3fb82a0b9698"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-9cbd9edec9f35f8d638b596da50c998c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T02:56:06.357Z","value":"3.5 LOW (2.0)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-9cbd9edec9f35f8d638b596da50c998c"},{"kind":"CVSS","as_of":"2026-06-17T02:56:06.357Z","value":"6.1 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-9cbd9edec9f35f8d638b596da50c998c"},{"kind":"CVSS","as_of":"2026-06-17T02:56:06.357Z","value":"6.3 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-9cbd9edec9f35f8d638b596da50c998c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-33b98fa6ed8dba7c3aba3fb82a0b9698","url":"https://github.com/advisories/GHSA-55mm-5399-7r63","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-55mm-5399-7r63","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.677Z"},{"id":"sr-9cbd9edec9f35f8d638b596da50c998c","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15128","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2020-15128","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T22:07:06.394Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-33b98fa6ed8dba7c3aba3fb82a0b9698"],"technology":"october/rain","known_exclusions":[],"conditions_summary":"### Impact\nPreviously encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. \n\nSpecifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. \n\n### Patches\nIssue has been patched in Build 468 (v1.0.468).\n\n>**NOTE**: If you are using the cookie session driver, all of your session data will be invalidated. All other session drivers should smoothly upgrade to the changes (although the backend authentication persist cookie will also be invalidated requiring users to login again once their cur","public_affected_ranges":["ECOSYSTEM: introduced 1.0.319; fixed 1.0.468"]}],"null_published_at":"2026-10-31T22:27:12.389Z","source_updated_at":"2026-09-10T03:48:31.648Z","source_disclosed_at":"2020-08-05T14:52:54.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:41:49.677Z"},{"id":"NVI-00003133","kind":"vulnerability","title":"Reliance on Cookies without validation in OctoberCMS","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-55mm-5399-7r63","CVE-2020-15128"],"plain_summary":"OSV carries this publisher advisory for october/rain. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.0.468 for october/rain. Confirm the publisher’s latest guidance.","source_ids":["sr-33b98fa6ed8dba7c3aba3fb82a0b9698"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-33b98fa6ed8dba7c3aba3fb82a0b9698","url":"https://github.com/advisories/GHSA-55mm-5399-7r63","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-55mm-5399-7r63","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.677Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-33b98fa6ed8dba7c3aba3fb82a0b9698"],"technology":"october/rain","known_exclusions":[],"conditions_summary":"### Impact\nPreviously encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. \n\nSpecifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. \n\n### Patches\nIssue has been patched in Build 468 (v1.0.468).\n\n>**NOTE**: If you are using the cookie session driver, all of your session data will be invalidated. All other session drivers should smoothly upgrade to the changes (although the backend authentication persist cookie will also be invalidated requiring users to login again once their cur","public_affected_ranges":["ECOSYSTEM: introduced 1.0.319; fixed 1.0.468"]}],"null_published_at":"2026-10-31T22:12:38.476Z","source_updated_at":"2026-09-10T03:48:31.648Z","source_disclosed_at":"2020-08-05T14:52:54.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:49.677Z"}],"next_cursor":null,"snapshot_revision":"42594"}