CVE-2021-21265

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan Improper Neutralization of HTTP Headers for Scripting Syntax pada octobercms october. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.

Rincian

Terbit di NVD

10 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 77,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 patch · advisory pihak ketiga
• https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 patch · advisory pihak ketiga
• https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp patch · advisory pihak ketiga
• https://github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10d
• https://github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30
• https://packagist.org/packages/october/backend