Medium
Missing server signature validation in OctoberCMS
Type: advisorySources: OSV
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to build 474 or v1.1.10. The only known workaround is to manually apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) which adds server signature validation.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-23655
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:40 UTC · Revision 1
Source evidence
Missing server signature validation in OctoberCMS
core-osv · Original sourcePublished 23 Feb 2022, 23:30 UTC
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to build 474 or v1.1.10. The only known workaround is to manually apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) which adds server signature validation.
osv:CVE-2022-23655
Complete source record
{
"id": "131d415e83fde151348db9ad73ff461b9e815b2bacb147b2cf524833960b1dac",
"url": "https://osv.dev/vulnerability/CVE-2022-23655",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Missing server signature validation in OctoberCMS",
"summary": "Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to build 474 or v1.1.10. The only known workaround is to manually apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) which adds server signature validation.",
"evidence": "osv:CVE-2022-23655",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2022-23655",
"aliases": [
"CVE-2022-23655",
"GHSA-53m6-44rc-h2q5"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/octobercms/october",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0fa592ba42eebd3c38621f14c9d9f4588278efab"
},
{
"introduced": "6389554935644bfbb15db5fcd0ce4db6cbe3d103"
},
{
"fixed": "e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.0.475"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.0"
},
{
"fixed": "1.1.11"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v1.0.474",
"v1.1.10",
"v1.1.9",
"v1.1.6",
"v1.0.473",
"v1.0.472",
"v1.1.5",
"v1.1.4",
"v1.1.3",
"v1.1.2",
"v1.1.1",
"v1.0.471",
"v1.0.470",
"v1.1.0",
"v1.0.469",
"v1.0.468",
"v1.0.467",
"v1.0.466",
"v1.0.464",
"v1.0.463",
"v1.0.462",
"v1.0.461",
"v1.0.460",
"v1.0.459",
"v1.0.458",
"v1.0.457",
"v1.0.455",
"v1.0.456",
"v1.0.454",
"v1.0.453",
"v1.0.452",
"v1.0.447",
"v1.0.451",
"v1.0.450",
"v1.0.449",
"v1.0.448",
"v1.0.446",
"v1.0.445",
"v1.0.444",
"v1.0.443",
"v1.0.442",
"v1.0.441",
"v1.0.440",
"v1.0.439",
"v1.0.438",
"v1.0.437",
"v1.0.436",
"v1.0.434",
"v1.0.433",
"v1.0.432",
"v1.0.431",
"v1.0.430",
"v1.0.429",
"v1.0.428",
"v1.0.427",
"v1.0.426",
"v1.0.425",
"v1.0.424",
"v1.0.423",
"v1.0.422",
"v1.0.421",
"v1.0.419",
"v1.0.420",
"v1.0.415",
"v1.0.418",
"v1.0.417",
"v1.0.416",
"v1.0.414",
"v1.0.413",
"v1.0.411",
"v1.0.412",
"v1.0.410",
"v1.0.409",
"v1.0.408",
"v1.0.407",
"v1.0.406",
"v1.0.405",
"v1.0.404",
"v1.0.396",
"v1.0.403",
"v1.0.402",
"v1.0.401",
"v1.0.400",
"v1.0.399",
"v1.0.398",
"v1.0.397",
"v1.0.395",
"v1.0.394",
"v1.0.393",
"v1.0.392",
"v1.0.391",
"v1.0.390",
"v1.0.389",
"v1.0.388",
"v1.0.387",
"v1.0.386",
"v1.0.385",
"v1.0.384",
"v1.0.383",
"v1.0.382",
"v1.0.381",
"v1.0.380",
"v1.0.379",
"v1.0.378",
"v1.0.377",
"v1.0.376",
"v1.0.375",
"v1.0.374",
"v1.0.373",
"v1.0.372",
"v1.0.371",
"v1.0.370",
"v1.0.367",
"v1.0.366",
"v1.0.365",
"v1.0.364",
"v1.0.363",
"v1.0.362",
"v1.0.361",
"v1.0.360",
"v1.0.359",
"v1.0.358",
"v1.0.356",
"v1.0.355",
"v1.0.354",
"v1.0.353",
"v1.0.352",
"v1.0.351",
"v1.0.346",
"v1.0.345",
"v1.0.344",
"v1.0.343",
"v1.0.342",
"v1.0.341",
"v1.0.340",
"v1.0.338",
"v1.0.334",
"v1.0.333",
"v1.0.331",
"v1.0.330",
"v1.0.329",
"v1.0.328",
"v1.0.327",
"v1.0.326",
"v1.0.325",
"v1.0.324",
"v1.0.323",
"v1.0.322",
"v1.0.321",
"v1.0.320",
"v1.0.319"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23655.json"
}
}
],
"modified": "2026-10-28T02:30:23.652729066Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23655.json",
"https://github.com/octobercms/october/security/advisories/GHSA-53m6-44rc-h2q5",
"https://nvd.nist.gov/vuln/detail/CVE-2022-23655",
"https://github.com/octobercms/october/commit/e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a"
],
"provider_metadata": {
"cwe_ids": [
"CWE-347"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23655.json"
}
},
"related_cves": [
{
"value": "CVE-2022-23655",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489973,
"published_at": "2022-02-23T23:30:09+00:00"
}