#VU56117 Improper Authentication in October CMS - CVE-2021-29487

Vulnerability identifier: #VU56117

Vulnerability risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-29487

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
October CMS
Web applications / CMS

Vendor: OctoberCMS

Description

The vulnerability allows a remote attacker to bypass authentication process and impersonate another user.

The vulnerability exists due to an error when handling authorization via persist cookies. A remote attacker can impersonate another application user and gain unauthorized access to the application.

Successful exploitation of the vulnerability requires knowledge of the Laravel’s secret key for cookie encryption and signing, and that a targeted user account is logged in during vulnerability exploitation.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

October CMS: 1.0.319 - 1.0.471, 1.1.0 - 1.1.4

---

External links
https://github.com/octobercms/october/security/advisories/GHSA-h76r-vgf3-j6w5/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.