CVE-2021-29487

Katalog CVE

CVSS 7.4 · High EPSS 0,90%

Kerentanan Improper Authentication pada octobercms october. Skor CVSS 3.1 7.4 (High) menurut github.com.

Deskripsi (NVD)

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability to bypass authentication and takeover of and user account on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability. The issue has been patched in Build 472 and v1.1.5.

Rincian

Terbit di NVD

26 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.4 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,90% peluang dieksploitasi; lebih tinggi dari 58,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 patch · advisory pihak ketiga
• https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 patch · advisory pihak ketiga
• https://github.com/octobercms/october/security/advisories/GHSA-h76r-vgf3-j6w5 patch · advisory pihak ketiga