Is CVE-2020-15128 actively exploited?

No active exploitation of CVE-2020-15128 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-15128 be exploited remotely?

Yes. CVE-2020-15128 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-15128?

CVE-2020-15128 has a CVSS score of 6.3 (MEDIUM).

HOME VULNERABILITIESCVE-2020-15128

MEDIUM

CVE-2020-15128

CWE-565Published: July 31, 2020· Updated: Jun 17, 2026

6.3

CVSS v3.1

Official Description

In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. Issue has been fixed in build 468 (v1.0.468).

NVD Source

Technical Analysis

CVE-2020-15128 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 6.3.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.