CVE-2021-3311

Katalog CVE

CVSS 9.8 · Critical EPSS 2,9%

Kerentanan Insufficient Session Expiration pada octobercms october. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.

Rincian

Terbit di NVD

5 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

2,9% peluang dieksploitasi; lebih tinggi dari 86,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://octobercms.com/forum/chan/announcements advisory vendor
• https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 patch · advisory pihak ketiga
• https://anisiosantos.me/october-cms-token-reactivation exploit · advisory pihak ketiga