CVE-2021-32648highunder attackCWE-287

CVE-2021-32648: high-severity vulnerability in octobercms october

Account Takeover in Octobercms

Published · Updated

Follow this CVE+ Monitor October CMS+ Monitor october/system

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.2epss 91%
from disclosure to weapon141 days
Published on NVDAug 26
1st PoC+141d
CISA KEV+145d
Action required by CISAfederal deadline: 2022-02-01

Apply updates per vendor instructions.

In short

An attacker can reset another user's password in OctoberCMS and take over their account by sending a specially crafted request. This allows unauthorized access to accounts without knowing the original password.

Technical detail

Authentication bypass in OctoberCMS password reset mechanism (CWE-287) allows an unauthenticated attacker to complete account takeover via a crafted request that bypasses validation checks during the reset process. The vulnerability affects october/system package versions prior to Build 472 and v1.1.5.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected products
octobercms · october
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — octobercms october

In the same product, most dangerous first.

CVE-2022-21705HIGHAuthenticated remote code execution in octobercmsEPSS 8.6%CVE-2020-5295MEDIUMLocal File read vulnerability in OctoberCMSEPSS 7.4%CVE-2021-32650HIGHArbitrary code execution in october/systemEPSS 2.2%CVE-2021-21265MEDIUMOctober CMS vulnerable to Potential Host Header Poisoning on misconfigured serversEPSS 1.7%CVE-2020-15246HIGHLocal File Inclusion by unauthenticated usersEPSS 1.7%CVE-2022-24800HIGHRace Condition in October CMS upload processEPSS 1.5%