octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the
    october/system package an attacker can request an account password reset and then gain access to the
    account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
    (CVE-2021-32648)

October CMS is a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.

ID	Name	Product	Family	Severity
417198	SCA: security update for october/system (GHSA-mxr5-mc97-63rc)	Tenable Cloud Security	SCA Checks	critical
417198	SCA: security update for october/system (GHSA-mxr5-mc97-63rc)	Tenable Self-Hosted Container Security	SCA Checks	critical
113505	October CMS 1.0.471 / 1.1.1 < 1.1.5 Improper Authentication	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2021-32648

critical

Tenable Plugins

critical

critical

critical