CVE-2021-21265 October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
Attackers can poison host headers on misconfigured October CMS servers to redirect users, requiring trusted host configuration or an upgrade.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21265?
CVE-2021-21265 is a medium-severity vulnerability in Octobercms October, published on 10 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.
Weakness: CWE-644
Which versions are affected by CVE-2021-21265?
2 open source packages ship an affected version, including october/backend. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
october/backend Packagist | All versions | 1.1.2 |
october/backend Packagist | All versions | 1.1.2 |
Products include Octobercms October.
How do I fix CVE-2021-21265?
Upgrade october/backend to 1.1.2 or later.
Is CVE-2021-21265 being exploited?
There is no known exploitation of CVE-2021-21265 in the wild and no public exploit code.
Other vulnerabilities in Octobercms October
Sources
Also known as GHSA-xhfx-hgmf-v6vp.