{"api_version":"1","generated_at":"2026-04-17T01:43:23+00:00","cve":"CVE-2022-23655","urls":{"html":"https://cve.report/CVE-2022-23655","api":"https://cve.report/api/cve/CVE-2022-23655.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-23655","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-23655"},"summary":{"title":"CVE-2022-23655","description":"Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to build 474 or v1.1.10. The only known workaround is to manually apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) which adds server signature validation.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2022-02-24 00:15:00","updated_at":"2022-03-07 17:15:00"},"problem_types":["CWE-347"],"metrics":[],"references":[{"url":"https://github.com/octobercms/october/commit/e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a","name":"https://github.com/octobercms/october/commit/e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a","refsource":"MISC","tags":[],"title":"Checks gateway server has a valid signature · octobercms/october@e3b455a · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/octobercms/october/security/advisories/GHSA-53m6-44rc-h2q5","name":"https://github.com/octobercms/october/security/advisories/GHSA-53m6-44rc-h2q5","refsource":"CONFIRM","tags":[],"title":"Compromised gateway causes data breach · Advisory · octobercms/october · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23655","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23655","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"23655","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"octobercms","cpe5":"october","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2022-23655","STATE":"PUBLIC","TITLE":"Missing server signature validation in OctoberCMS"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"october","version":{"version_data":[{"version_value":">= 1.1.0, < 1.1.11"},{"version_value":"< 1.0.475"}]}}]},"vendor_name":"octobercms"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to build 474 or v1.1.10. The only known workaround is to manually apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) which adds server signature validation."}]},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-347: Improper Verification of Cryptographic Signature"}]}]},"references":{"reference_data":[{"name":"https://github.com/octobercms/october/security/advisories/GHSA-53m6-44rc-h2q5","refsource":"CONFIRM","url":"https://github.com/octobercms/october/security/advisories/GHSA-53m6-44rc-h2q5"},{"name":"https://github.com/octobercms/october/commit/e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a","refsource":"MISC","url":"https://github.com/octobercms/october/commit/e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a"}]},"source":{"advisory":"GHSA-53m6-44rc-h2q5","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2022-02-24 00:15:00","lastModifiedDate":"2022-03-07 17:15:00","problem_types":["CWE-347"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.6,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":2.6},"severity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*","versionEndExcluding":"1.0.475","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*","versionStartIncluding":"1.1.0","versionEndExcluding":"1.1.11","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"23655","Ordinal":"226499","Title":"CVE-2022-23655","CVE":"CVE-2022-23655","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"23655","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}