p PatchFirst

CVE-2021-32648

CVE-2021-32648 · Account Takeover in Octobercms

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

CVSS 8.2 · Высокий · EPSS 90,4% · В каталоге KEV · Публичный эксплойт · Есть исправление

Опубликовано
Обновлено

Стек: php

Затронутые продукты и версии

  • october

    Версии
    • >= 1.0.471, < 1.0.472: Затронуто
    • >= 1.1.1, < 1.1.5: Затронуто

    Нет опубликованного исправления

  • october/system Packagist

    Версии
    • v1.0.319
    • v1.0.320
    • v1.0.321
    • v1.0.322
    • v1.0.323
    • v1.0.324
    • v1.0.325
    • v1.0.326
    • v1.0.327
    • v1.0.328
    • v1.0.329
    • v1.0.330
    • v1.0.331
    • v1.0.332
    • v1.0.333
    • v1.0.334
    • v1.0.335
    • v1.0.336
    • v1.0.337
    • v1.0.338
    • v1.0.339
    • v1.0.340
    • v1.0.341
    • v1.0.342
    • v1.0.343
    • v1.0.344
    • v1.0.345
    • v1.0.346
    • v1.0.347
    • v1.0.348
    • v1.0.349
    • v1.0.350
    • v1.0.351
    • v1.0.352
    • v1.0.353
    • v1.0.354
    • v1.0.355
    • v1.0.356
    • v1.0.357
    • v1.0.358
    • v1.0.359
    • v1.0.360
    • v1.0.361
    • v1.0.362
    • v1.0.363
    • v1.0.364
    • v1.0.365
    • v1.0.366
    • v1.0.367
    • v1.0.368
    • v1.0.369
    • v1.0.370
    • v1.0.371
    • v1.0.372
    • v1.0.373
    • v1.0.374
    • v1.0.375
    • v1.0.376
    • v1.0.377
    • v1.0.378
    • v1.0.379
    • v1.0.380
    • v1.0.381
    • v1.0.382
    • v1.0.383
    • v1.0.384
    • v1.0.385
    • v1.0.386
    • v1.0.387
    • v1.0.388
    • v1.0.389
    • v1.0.390
    • v1.0.391
    • v1.0.392
    • v1.0.393
    • v1.0.394
    • v1.0.395
    • v1.0.396
    • v1.0.397
    • v1.0.398
    • v1.0.399
    • v1.0.400
    • v1.0.401
    • v1.0.402
    • v1.0.403
    • v1.0.404
    • v1.0.405
    • v1.0.406
    • v1.0.407
    • v1.0.408
    • v1.0.409
    • v1.0.410
    • v1.0.411
    • v1.0.412
    • v1.0.413
    • v1.0.414
    • v1.0.415
    • v1.0.416
    • v1.0.417
    • v1.0.418
    • v1.0.419
    • v1.0.420
    • v1.0.421
    • v1.0.422
    • v1.0.423
    • v1.0.424
    • v1.0.425
    • v1.0.426
    • v1.0.427
    • v1.0.428
    • v1.0.429
    • v1.0.430
    • v1.0.431
    • v1.0.432
    • v1.0.433
    • v1.0.434
    • v1.0.435
    • v1.0.436
    • v1.0.437
    • v1.0.438
    • v1.0.439
    • v1.0.440
    • v1.0.441
    • v1.0.442
    • v1.0.443
    • v1.0.444
    • v1.0.445
    • v1.0.446
    • v1.0.447
    • v1.0.448
    • v1.0.449
    • v1.0.450
    • v1.0.451
    • v1.0.452
    • v1.0.453
    • v1.0.454
    • v1.0.455
    • v1.0.456
    • v1.0.457
    • v1.0.458
    • v1.0.459
    • v1.0.460
    • v1.0.461
    • v1.0.462
    • v1.0.463
    • v1.0.464
    • v1.0.465
    • v1.0.466
    • v1.0.467
    • v1.0.468
    • v1.0.469
    • v1.0.470
    • v1.0.471
    Затронутые диапазоны версий
    • ECOSYSTEM: < 1.0.472

    Обновитесь до 1.0.472

  • october/system Packagist

    Версии
    • v1.1.1
    • v1.1.2
    • v1.1.3
    • v1.1.4
    Затронутые диапазоны версий
    • ECOSYSTEM: ≥ 1.1.1, < 1.1.5

    Обновитесь до 1.1.5

Первоисточники

Проверьте свой сервер →