Session ID Reactivation Vulnerability in October CMS by October

CVE-2021-3311

What is CVE-2021-3311?

In October CMS, a session ID reactivation issue was identified that allows a previously invalidated session ID to be reused upon a new login. This can occur if an attacker has prior knowledge of an old session ID. Although the flaw alters the expected authentication process in Auth/Manager.php, its impact is contingent upon the familiarity an attacker has with old session credentials.

References