Vulnerability · Published Oct 6, 2021 · Assigned by GitHub_M
CVE-2021-41126Deleted Admin Can Sign In to Admin Interface
High 7.2
In plain English
A high-severity improper authentication in october from octobercms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | october/october | 2.1.12 | GHSA-6gjf-7w99-j7x7 |
| Packagist | october/system | 2.1.12 | GHSA-6gjf-7w99-j7x7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| octobercms | october | >= 2.0.0, < 2.1.12 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/octobercms/october/security/advisories/GHSA-6gjf-7w99-j7x7 x_refsource_CONFIRM
- https://octobercms.com/changelog x_refsource_MISC