CVE record
CVE-2021-32648
October CMS Improper Authentication
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
CVE evidence
Known exploitation
Listed in CISA KEV
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
critical
CVSS 9.1 · CVSS_V3
Affected packages
1
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
CISA Known Exploited Vulnerabilities
Catalog record
- Vendor / project
- October CMS
- Product
- October CMS
- Date added
- Jan 18, 2022
- CISA federal remediation due date
- Feb 1, 2022
- Required action
- Apply updates per vendor instructions.
- Known ransomware campaign use
- Unknown
- CWE
- CWE-287
OSV package mapping
Affected open-source packages
| Package | Ecosystem | Fixed versions |
|---|---|---|
| october/system | composer | 1.0.472, 1.1.5 |