PT-2021-4044 · Unknown · Laravel Php Framework+1

Alexander Sidukov + 4 · Published 2021-08-26 · Updated 2025-10-24 · CVE-2021-32648

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions October CMS versions prior to Build 472 and v1.1.5

Description The issue is related to an improper authentication mechanism in the October CMS platform, which is based on the Laravel PHP Framework. An attacker can exploit this by requesting an account password reset and then gaining access to the account using a specially crafted request.

Recommendations For versions prior to Build 472 and v1.1.5, update to Build 472 or v1.1.5 to resolve the issue. As a temporary workaround, consider restricting access to the account password reset feature until the update is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-640

Related Identifiers

BDU:2021-04572

CVE-2021-32648

GHSA-MXR5-MC97-63RC

Affected Products

Laravel Php Framework

October Cms

References · 17

• 🔥 https://github.com/Immersive-Labs-Sec/CVE-2021-32648 · Exploit
• https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 · Patch
• https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 · Patch
• https://osv.dev/vulnerability/CVE-2021-32648 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mxr5-mc97-63rc · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04572 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32648 · Security Note
• https://github.com/octobercms/october · Note
• https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc · Vendor Advisory, Patch
• https://twitter.com/pdnuclei_bot/status/1969038805442371940 · Twitter Post
• https://t.me/cibsecurity/27916 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32648 · Note
• https://t.me/cybersecuritytechnologies/5245 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/20209 · Telegram Post