Miggo Logo

CVE-2020-11094: Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar

6.1

CVSS Score
3.1

Basic Information

EPSS Score
0.66922%
Published
6/3/2020
Updated
1/9/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
rainlab/debugbar-plugincomposer< 3.1.03.1.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from insufficient access controls in two key areas:

  1. The Plugin's boot method enabled debugbar functionality with only a basic backend auth check, not granular permissions.
  2. The underlying debugbar implementation (from Barryvdh) exposed sensitive data endpoints without OctoberCMS permission integration. The patch added permission checks in both the Plugin's workflow (via registerPermissions) and replaced the third-party ServiceProvider with a customized version implementing permission gates. The confidence is high for the Plugin::boot method (explicitly modified in the commit) and medium for the third-party ServiceProvider (implied by its replacement).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** ***u***r *ont*ins * p*r**ps littl* known ***tur* w**r* it will lo* *ll r*qu*sts (*n* *ll in*orm*tion p*rt*inin* to **** r*qu*st in*lu*in* s*ssion **t*) w**n*v*r it is *n**l**. T*is pr*s*nts * pro*l*m i* t** plu*in is *v*r *n**l** on *

Reasoning

T** vuln*r**ility st*mm** *rom insu**i*i*nt ****ss *ontrols in two k*y *r**s: *. T** Plu*in's *oot m*t*o* *n**l** ***u***r *un*tion*lity wit* only * **si* ***k*n* *ut* ****k, not *r*nul*r p*rmissions. *. T** un**rlyin* ***u***r impl*m*nt*tion (*rom *