CVE-2021-3311
 
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.
Se detectó un problema en October hasta el build 471. Reactiva una ID de una sesión anterior (que había sido no válida después de cerrar la sesión) una vez que se produce un nuevo inicio de sesión. NOTA: esto viola el comportamiento de autenticación del archivo Auth/Manager.php previsto pero, cierto es que, solo es relevante si un ID de sesión antiguo es conocido por el atacante
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-01-26 CVE Reserved
- 2021-02-05 CVE Published
- 2024-06-10 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-613: Insufficient Session Expiration
CAPEC
References (3)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://anisiosantos.me/october-cms-token-reactivation | 2024-08-03 |
URL | Date | SRC |
---|---|---|
https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 | 2021-03-15 |
URL | Date | SRC |
---|---|---|
https://octobercms.com/forum/chan/announcements | 2021-03-15 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Octobercms Search vendor "Octobercms" | October Search vendor "Octobercms" for product "October" | <= 1.0.471 Search vendor "Octobercms" for product "October" and version " <= 1.0.471" | - |
Affected
|