Session Fixation in October CMS - CVE-2021-3311
Published: February 5, 2021 / Updated: March 8, 2021
Vulnerability identifier: #VU50409
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-3311
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to impersonate CMS users.
The vulnerability exists due to October CMS does not invalidate old session identifiers after user logout. A remote attacker with knowledge of any previous session identifier can reuse it by bypass authentication processed and gain unauthorized access to the application.
Affected software
October CMS
How to mitigate CVE-2021-3311
Install update from vendor's website.
October CMS - update to 1.1.2