CVE-2021-3311 October CMS Session ID not invalidated after logout
An attacker with a known old session ID can reactivate it after logout to hijack a user's authenticated session.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3311?
CVE-2021-3311 is a critical authentication bypass vulnerability in Octobercms October, published on 5 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.
Weakness: CWE-613
Which versions are affected by CVE-2021-3311?
4 open source packages ship an affected version, including october/rain. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
october/rain Packagist | All versions | 1.0.472 |
october/rain Packagist | All versions | 1.0.472 |
october/rain Packagist | From 1.1.0 | 1.1.2 |
october/rain Packagist | From 1.1.0 | 1.1.2 |
Products include Octobercms October.
How do I fix CVE-2021-3311?
Upgrade october/rain to a fixed version for your release line: 1.0.472 or 1.1.2.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-3311 being exploited?
There is no known exploitation of CVE-2021-3311 in the wild and no public exploit code.
Other vulnerabilities in Octobercms October
Sources
Also known as GHSA-7ggw-h8pp-r95r.