Skip to content
Log inStart free trial

GHSA-mxr5-mc97-63rc GHSA-mxr5-mc97-63rc

Account Takeover in Octobercms

Critical Known exploited Packagist
Severity
8.2 / 10
Critical · CVSS 3.1
Exploit chance (EPSS)
91.22%
Chance of exploitation in the next 30 days. Higher than 99.81% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog
Weakness
CWE-287 Improper Authentication
Fix
1.0.472
Upgrade october/system to this version or later

Description

Impact

An attacker can request an account password reset and then gain access to the account using a specially crafted request.

  • To exploit this vulnerability, an attacker must know the username of an administrator and have access to the password reset form.

Patches

Workarounds

Apply https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 and https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 to your installation manually if you are unable to upgrade.

[Update 2022-01-20] Shortened patch instructions can be found here.

Recommendations

We recommend the following steps to make sure your server stays secure:

  • Keep server OS and system software up to date.
  • Keep October CMS software up to date.
  • Use a multi-factor authentication plugin.
  • Change the default backend URL or block public access to the backend area.
  • Include the Roave/SecurityAdvisories Composer package to ensure that your application doesn't have installed dependencies with known security vulnerabilities.

References

Bugs found as part of Solar Security CMS Research. Credits to: • Andrey Basarygin • Andrey Guzei • Mikhail Khramenkov • Alexander Sidukov • Maxim Teplykh

For more information

If you have any questions or comments about this advisory:

Affected versions

Packagist

PackageVulnerableFixed in
october/system
< 1.0.472
1.0.472
october/system
>= 1.1.1, < 1.1.5
1.1.5
october/system
< 1.0.472
1.0.472
october/system
>= 1.1.1, < 1.1.5
1.1.5

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

october/system Packagist → 1.0.472

composer
composer require october/system:^1.0.472

Severity breakdown

CVSS 3.1 8.2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Exploit maturity
H

Weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it
  • Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
AdvisorySeverityWhy it's related
GHSA-f9x3-7vq9-cph6
Laravel TokenGuard authentication bypass through non-string API credentials
Critical Same weakness, CWE-287
GHSA-r4xp-prcw-77qf
better-auth: OAuth Proxy lets an attacker sign in as another user
Critical Same weakness, CWE-287
GHSA-965c-763c-88jm
better-auth: OAuth state can be used as a Magic Link to sign in as another user
Critical Same weakness, CWE-287
GO-2026-6773
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
High Same weakness, CWE-287
GO-2026-6786
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
High Same weakness, CWE-287
GHSA-xv7q-fvmc-jx96
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
High Same weakness, CWE-287
GHSA-68w4-83fh-f2w8
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
High Same weakness, CWE-287
GHSA-r44w-v6gf-x3p6
pyLoad has an authentication bypass in API key validation (check_apikey cache)
High Same weakness, CWE-287
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor