{"id":"CVE-2021-3311","published":"2021-02-05T04:47:53Z","modified":"2024-08-03T16:53:17Z","title":"An issue was discovered in October through build 471","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02939,"percentile":0.87113,"provenance":"source"},"cwes":[],"references":[{"url":"https://octobercms.com/forum/chan/announcements","tags":["x_refsource_MISC"]},{"url":"https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024","tags":["x_refsource_CONFIRM"]},{"url":"https://anisiosantos.me/october-cms-token-reactivation","tags":["x_refsource_MISC"]}],"priority":{"score":17.4,"factors":[{"name":"EPSS percentile","points":17.42}]},"affected":[{"ecosystem":"Packagist","package":"october/rain","vulnerableRanges":["<1.0.472",">=1.1.0, <1.1.2"],"patched":["1.0.472","1.1.2"],"from":["GHSA-7ggw-h8pp-r95r"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0537","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-octobercms-october-cve-2021-3311","children":[{"from":"CVE-2021-3311","to":"CVE-2021-29487","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Auth/Manager.php"],"commits":["https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374","https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9","https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024"],"basis":"rarely changed file"}]},{"from":"CVE-2021-3311","to":"CVE-2021-32648","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Auth/Manager.php"],"commits":["https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374","https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9","https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2017-15284","published":"2017-10-12","fixed":"1.0.426","kev":false},{"cve":"CVE-2020-15128","published":"2020-07-31","fixed":"1.0.468","kev":false,"link":{"from":"CVE-2020-15128","to":"CVE-2021-3311","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:october/rain","fromFixed":"1.0.468","toFixed":"1.0.472","daysApart":189}]}},{"cve":"CVE-2021-3311","published":"2021-02-05","fixed":"1.1.2","kev":false},{"cve":"CVE-2026-22692","published":"2026-04-14","fixed":"4.1.5","kev":false},{"cve":"CVE-2026-25125","published":"2026-04-14","fixed":"4.1.10","kev":false},{"cve":"CVE-2026-25133","published":"2026-04-14","fixed":"4.1.10","kev":false}],"package":"Packagist:october/rain"}}