#VU56117 Improper Authentication in October CMS - CVE-2021-29487
Published: August 26, 2021
Vulnerability identifier: #VU56117
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2021-29487
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
October CMS
October CMS
Software vendor:
OctoberCMS
OctoberCMS
Description
The vulnerability allows a remote attacker to bypass authentication process and impersonate another user.
The vulnerability exists due to an error when handling authorization via persist cookies. A remote attacker can impersonate another application user and gain unauthorized access to the application.
Successful exploitation of the vulnerability requires knowledge of the Laravel’s secret key for cookie encryption and signing, and that a targeted user account is logged in during vulnerability exploitation.
Remediation
Install updates from vendor's website.