PT-2021-20051 · Octobercms · October

Daftspunk · Published 2021-02-05 · Updated 2021-03-15 · CVE-2021-3311

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions October versions prior to 1.0.472 October versions prior to 1.1.2

Description An issue was discovered where an old session ID is reactivated once a new login occurs, violating the intended authentication behavior. This issue is relevant if an old session ID is known to an attacker. When logging out, the session ID was not invalidated, which means that anyone who gained access to the old session cookie would be able to act as the logged-in user.

Recommendations For versions prior to 1.0.472, update to Build 472 or apply the patch from https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 to your installation manually. For versions prior to 1.1.2, update to v1.1.2 or apply the patch from https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 to your installation manually.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2021-3311

GHSA-7GGW-H8PP-R95R

Affected Products

October

References · 10

• 🔥 https://anisiosantos.me/october-cms-token-reactivation · Exploit
• https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 · Patch
• https://osv.dev/vulnerability/GHSA-7ggw-h8pp-r95r · Vendor Advisory
• https://octobercms.com/forum/chan/announcements · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3311 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3311 · Vendor Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-7ggw-h8pp-r95r · Note
• https://t.me/cibsecurity/23163 · Telegram Post
• http://cve.circl.lu/cve/CVE-2021-3311 · Note
• https://packagist.org/packages/october/rain · Note