PT-2024-20542 · October · October

Benzetaa · Published 2024-06-26 · Updated 2024-09-19 · CVE-2024-24764

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions October versions prior to 3.5.15

Description This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (october://) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user.

Recommendations For versions prior to 3.5.15, update to version 3.5.15 to resolve the issue. As a temporary workaround, consider restricting access to the page finder link schema (october://) to minimize the risk of exploitation.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-24764

GHSA-V2VF-JV88-3FP5

Affected Products

October

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24764.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24764 · Security Note
• https://osv.dev/vulnerability/GHSA-v2vf-jv88-3fp5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-24764 · Vendor Advisory
• https://github.com/octobercms/october · Note
• https://github.com/octobercms/october/security/advisories/GHSA-v2vf-jv88-3fp5 · Note
• https://t.me/cvenotify/95299 · Telegram Post
• https://t.me/cvenotify/84434 · Telegram Post