CVE-2021-32648
Published 2021-08-26 · Updated 2026-06-17 · Source security-advisories@github.com
Summary
CVE-2021-32648 is a high-severity (CVSS 8.2) vulnerability in October CMS October CMS. CISA added it to the Known Exploited Vulnerabilities catalog on January 18, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 1, 2022. CISA does not currently list it as used in ransomware campaigns.
All 1 known-exploited October CMS vulnerabilities →Description
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CISA Known-Exploited Vulnerability
Product: October CMS — October CMS
Name: October CMS Improper Authentication
Date added: 2022-01-18 · Due: 2022-02-01
Required action: Apply updates per vendor instructions.
References
- https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374
- https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9
- https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc
- https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374
- https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9
- https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32648