Description
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| octobercms | october | >= 1.0.471, < 1.0.472, >= 1.1.1, < 1.1.5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
Immersive-Labs-Sec/CVE-2021-32648 ★ 12 · Jan 14, 2022
Proof Of Concept code for OctoberCMS Auth Bypass CVE-2021-32648
-
daftspunk/CVE-2021-32648 ★ 1 · Jan 20, 2022
Patch your code for October CMS Auth Bypass CVE-2021-32648
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- OctoberCMS - Account Takeover http/cves/2021/CVE-2021-32648.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | october/system | < 1.0.472 | 1.0.472 | GHSA-mxr5-mc97-63rc |
| Packagist | october/system | >= 1.1.1, < 1.1.5 | 1.1.5 | GHSA-mxr5-mc97-63rc |