CVE-2017-16244
High
Description
Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.
SeverityHigh
CVSS8.8
Exploit probability—
ProductOctober
PublishedNov 1, 2017
First seenNov 1, 2017
How to fix
Update
- october/october1.0.427 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| octobercms october | 1.0.426 | — |
| october/octoberPackagist | v < 1.0.427 | 1.0.427 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.