{"id":"CVE-2021-29487","published":"2021-08-26T19:00:18Z","modified":"2024-08-03T22:11:05Z","title":"Authentication bypass in Octobercms","vendor":"octobercms","product":"october","tier":"tail","description":{"text":"octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability to bypass authentication and takeover of and user account on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability. The issue has been patched in Build 472 and v1.1.5.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00895,"percentile":0.5942,"provenance":"source"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374","tags":["x_refsource_MISC"]},{"url":"https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9","tags":["x_refsource_MISC"]},{"url":"https://github.com/octobercms/october/security/advisories/GHSA-h76r-vgf3-j6w5","tags":["x_refsource_CONFIRM"]}],"priority":{"score":17.1,"factors":[{"name":"EPSS percentile","points":11.88},{"name":"CVSS severity","points":5.18}]},"vendorSlug":"octobercms","affectedVersions":[{"vendor":"octobercms","product":"october","versions":[">= 1.0.471, < 1.0.472",">= 1.1.1, < 1.1.5"]}],"affected":[{"ecosystem":"Packagist","package":"october/system","vulnerableRanges":["<1.0.472",">=1.1.1, <1.1.5"],"patched":["1.0.472","1.1.5"],"from":["GHSA-h76r-vgf3-j6w5"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1741","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-octobercms-october-cve-2021-3311","parents":[{"from":"CVE-2021-3311","to":"CVE-2021-29487","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Auth/Manager.php"],"commits":["https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374","https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9","https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2021-29487","published":"2021-08-26","fixed":"1.1.5","kev":false},{"cve":"CVE-2021-32648","published":"2021-08-26","fixed":"1.1.5","kev":true},{"cve":"CVE-2021-32649","published":"2022-01-14","fixed":"1.1.6","kev":false,"link":{"from":"CVE-2021-29487","to":"CVE-2021-32649","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:october/system","fromFixed":"1.1.5","toFixed":"1.1.6","daysApart":141}]}},{"cve":"CVE-2021-32650","published":"2022-01-14","fixed":"1.1.6","kev":false,"link":{"from":"CVE-2021-29487","to":"CVE-2021-32650","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:october/system","fromFixed":"1.1.5","toFixed":"1.1.6","daysApart":141}]}}],"package":"Packagist:october/system"}}