CVE-2021-32648

Katalog CVE

CVSS 9.1 · Critical KEV · sudah dieksploitasi EPSS 90,4%

Kerentanan Improper Authentication pada octobercms october. Skor CVSS 3.1 9.1 (Critical) menurut NVD. Masuk katalog KEV CISA pada 18 Januari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

Rincian

Terbit di NVD

26 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

90,4% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

October CMS Improper Authentication

Masuk KEV

18 Januari 2022

Tenggat CISA

1 Februari 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc patch · advisory vendor
• https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 patch
• https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32648 pemerintah AS