CVE-2021-21265mediumCWE-644

CVE-2021-21265: falha de média gravidade em octobercms october

October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar October CMS+ Monitorar october/backend

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 1.7%
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Produtos afetados
octobercms · october
CVEs relacionadas — octobercms october

No mesmo produto, das mais perigosas para as menos.

CVE-2021-32648HIGHAccount Takeover in OctobercmsEPSS 91.2%KEVCVE-2022-21705HIGHAuthenticated remote code execution in octobercmsEPSS 8.6%CVE-2020-5295MEDIUMLocal File read vulnerability in OctoberCMSEPSS 7.4%CVE-2021-32650HIGHArbitrary code execution in october/systemEPSS 2.2%CVE-2020-15246HIGHLocal File Inclusion by unauthenticated usersEPSS 1.7%CVE-2022-24800HIGHRace Condition in October CMS upload processEPSS 1.5%