CVE-2021-41126
High
Description
October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.
SeverityHigh
CVSS7.2
Exploit probability—
ProductOctober
PublishedOct 6, 2021
First seenOct 6, 2021
Weakness typeCWE-287Improper authentication
How to fix
Update
- octobercms october2.1.12 or later
- october/october2.1.12 or later
- october/system2.1.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| octobercms october | 2.0.0 ≤ v < 2.1.12 | 2.1.12 |
| october/octoberPackagist | 2.1.0 ≤ v < 2.1.12 | 2.1.12 |
| october/systemPackagist | 2.1.0 ≤ v < 2.1.12 | 2.1.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.