October CMS Platform Vulnerability: Authenticated Administrators at Risk of Redirection to Untrusted URL
CVE-2024-24764

4.8MEDIUM

Key Information:

Vendor

October

Status
October
Vendor
CVE Published:
26 June 2024

What is CVE-2024-24764?

October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (october://) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability has been patched in version 3.5.15.

References

https://github.com/octobercms/october/security/advisories...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.