CVE-2021-32648 October CMS Improper Authentication
Attackers can hijack user accounts by exploiting a flaw in the password reset mechanism of October CMS.
- Exploited in the wild
- Since 18 Jan 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-32648?
CVE-2021-32648 is a high-severity authentication bypass vulnerability in Octobercms October, published on 26 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
Weakness: CWE-287
Which versions are affected by CVE-2021-32648?
4 open source packages ship an affected version, including october/system. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
october/system Packagist | All versions | 1.0.472 |
october/system Packagist | All versions | 1.0.472 |
october/system Packagist | From 1.1.1 | 1.1.5 |
october/system Packagist | From 1.1.1 | 1.1.5 |
Products include Octobercms October.
How do I fix CVE-2021-32648?
Upgrade october/system to a fixed version for your release line: 1.0.472 or 1.1.5. US federal agencies must fix it by 1 Feb 2022.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-32648 being exploited?
Yes. Attackers have exploited CVE-2021-32648 in the wild since at least 18 Jan 2022.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Octobercms October
Sources
Also known as GHSA-mxr5-mc97-63rc.