Vulnerability · Published Mar 10, 2021 · Assigned by GitHub_M
CVE-2021-21265October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
Medium 6.8
In plain English
A medium-severity security flaw in october from octobercms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | october/backend | 1.1.2 | GHSA-xhfx-hgmf-v6vp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| octobercms | october | < 1.1.2 |
Weakness: CWE-644 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
References
- https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp x_refsource_CONFIRM
- https://github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10d x_refsource_MISC
- https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 x_refsource_MISC
- https://github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30 x_refsource_MISC
- https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 x_refsource_MISC
- https://packagist.org/packages/october/backend x_refsource_MISC