Vulnerability Description
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Octobercms | October | < 1.1.2 |
Related Weaknesses (CWE)
References
- https://github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec45
- https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b1PatchThird Party Advisory
- https://github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536
- https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306PatchThird Party Advisory
- https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vpPatchThird Party Advisory
- https://packagist.org/packages/october/backend
- https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b1PatchThird Party Advisory
- https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306PatchThird Party Advisory
- https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vpPatchThird Party Advisory
FAQ
What is CVE-2021-21265?
CVE-2021-21265 is a vulnerability with a CVSS score of 6.8 (MEDIUM). October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any requ...
How severe is CVE-2021-21265?
CVE-2021-21265 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-21265?
Check the references section above for vendor advisories and patch information. Affected products include: Octobercms October.