Actively exploited · Published Aug 26, 2021 · Assigned by GitHub_M
CVE-2021-32648Account Takeover in Octobercms
High 8.2 Exploited
In plain English
A high-severity improper authentication in october from octobercms. Attackers are actively exploiting it in the wild (listed by CISA on January 18, 2022). The chance it is exploited in the next 30 days is estimated at 91.1% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Feb 1, 2022.
Official description
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | october/system | 1.0.472 | GHSA-mxr5-mc97-63rc |
| Packagist | october/system | 1.1.5 | GHSA-mxr5-mc97-63rc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| octobercms | october | >= 1.0.471, < 1.0.472>= 1.1.1, < 1.1.5 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc x_refsource_CONFIRM
- https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 x_refsource_MISC
- https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32648 government-resource