PT-2021-23109 · October · October Cms

Daniel Bidala · Published 2021-10-06 · Updated 2021-10-14 · CVE-2021-41126

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions October CMS versions prior to 2.1.12

Description The issue affects administrator accounts in October CMS, which is a Content Management System (CMS) and web platform built on the Laravel PHP Framework. Administrator accounts that had previously been deleted may still be able to sign in to the backend.

Recommendations For versions prior to 2.1.12, update to version 2.1.12 or later to resolve the issue. As a temporary workaround, consider resetting the password of the deleted accounts to prevent them from signing in. If you are unable to upgrade, contact [e-mail] for code change instructions.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-41126

GHSA-6GJF-7W99-J7X7

Affected Products

October Cms

References · 7

• https://octobercms.com/changelog · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41126 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41126 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6gjf-7w99-j7x7 · Vendor Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-6gjf-7w99-j7x7 · Note
• https://github.com/octobercms/october · Note
• https://t.me/cibsecurity/30099 · Telegram Post