October CMS · October CMS
October CMS, a Laravel-based content management platform, contains an improper authentication flaw in the october/system package that affects its account password reset functionality. An attacker who can reach the application over the network, with no credentials and no user interaction, can request a password reset and then use a specially crafted request to gain access to the targeted account.
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
First seen exploited 5 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 5 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
3 related vulnerabilities in the same code over 7 months.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Gains access to legitimate user accounts
gain access to the account using a specially crafted request
Unauthenticated web request exploits public-facing CMS application
an attacker can request an account password reset and then gain access to the account
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: october/system.
Upgrade to 1.1.5 or later
Set the version to 1.1.5 or later in your composer.json.
The first fix for CVE-2021-32648. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 1.1.1 up to 1.1.5 | 1.1.5 |
| All versions before 1.0.472 | 1.0.472 |
“Up to” means the second version is the fix and is not affected.
Reports are matched by finding the exact id CVE-2021-32648 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.