Vulnerabilities > CVE-2021-21265 - Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in Octobercms October

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

octobercms

CWE-644

NVD

Published: 2021-03-10

Updated: 2021-03-18

Summary

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.

Vulnerable Configurations

Part	Description	Count
Application	Octobercms Octobercms October - Octobercms October 1.0.45 Octobercms October 1.0.46 Octobercms October 1.0.47 Octobercms October 1.0.48 Octobercms October 1.0.49 Octobercms October 1.0.50 Octobercms October 1.0.51 Octobercms October 1.0.52 Octobercms October 1.0.53 Octobercms October 1.0.54 Octobercms October 1.0.55 Octobercms October 1.0.56 Octobercms October 1.0.57 Octobercms October 1.0.58 Octobercms October 1.0.59 Octobercms October 1.0.60 Octobercms October 1.0.61 Octobercms October 1.0.62 Octobercms October 1.0.63 Octobercms October 1.0.64 Octobercms October 1.0.65 Octobercms October 1.0.66 Octobercms October 1.0.67 Octobercms October 1.0.68 Octobercms October 1.0.69 Octobercms October 1.0.70 Octobercms October 1.0.71 Octobercms October 1.0.72 Octobercms October 1.0.73 Octobercms October 1.0.74 Octobercms October 1.0.75 Octobercms October 1.0.76 Octobercms October 1.0.77 Octobercms October 1.0.78 Octobercms October 1.0.79 Octobercms October 1.0.80 Octobercms October 1.0.81 Octobercms October 1.0.82 Octobercms October 1.0.83 Octobercms October 1.0.84 Octobercms October 1.0.85 Octobercms October 1.0.86 Octobercms October 1.0.87 Octobercms October 1.0.88 Octobercms October 1.0.89 Octobercms October 1.0.90 Octobercms October 1.0.91 Octobercms October 1.0.92 Octobercms October 1.0.93 Octobercms October 1.0.94 Octobercms October 1.0.95 Octobercms October 1.0.96 Octobercms October 1.0.97 Octobercms October 1.0.98 Octobercms October 1.0.99 Octobercms October 1.0.100 Octobercms October 1.0.101 Octobercms October 1.0.102 Octobercms October 1.0.103 Octobercms October 1.0.104 Octobercms October 1.0.105 Octobercms October 1.0.106 Octobercms October 1.0.107 Octobercms October 1.0.108 Octobercms October 1.0.109 Octobercms October 1.0.110 Octobercms October 1.0.111 Octobercms October 1.0.112 Octobercms October 1.0.113 Octobercms October 1.0.114 Octobercms October 1.0.115 Octobercms October 1.0.116 Octobercms October 1.0.117 Octobercms October 1.0.118 Octobercms October 1.0.119 Octobercms October 1.0.120 Octobercms October 1.0.121 Octobercms October 1.0.122 Octobercms October 1.0.123 Octobercms October 1.0.124 Octobercms October 1.0.125 Octobercms October 1.0.126 Octobercms October 1.0.127 Octobercms October 1.0.128 Octobercms October 1.0.129 Octobercms October 1.0.130 Octobercms October 1.0.131 Octobercms October 1.0.132 Octobercms October 1.0.133 Octobercms October 1.0.134 Octobercms October 1.0.135 Octobercms October 1.0.136 Octobercms October 1.0.137 Octobercms October 1.0.138 Octobercms October 1.0.139 Octobercms October 1.0.140 Octobercms October 1.0.141 Octobercms October 1.0.142 Octobercms October 1.0.143 Octobercms October 1.0.144 Octobercms October 1.0.145 Octobercms October 1.0.146 Octobercms October 1.0.147 Octobercms October 1.0.148 Octobercms October 1.0.149 Octobercms October 1.0.150 Octobercms October 1.0.151 Octobercms October 1.0.152 Octobercms October 1.0.153 Octobercms October 1.0.154 Octobercms October 1.0.155 Octobercms October 1.0.156 Octobercms October 1.0.157 Octobercms October 1.0.158 Octobercms October 1.0.159 Octobercms October 1.0.160 Octobercms October 1.0.161 Octobercms October 1.0.162 Octobercms October 1.0.163 Octobercms October 1.0.164 Octobercms October 1.0.165 Octobercms October 1.0.166 Octobercms October 1.0.167 Octobercms October 1.0.168 Octobercms October 1.0.169 Octobercms October 1.0.170 Octobercms October 1.0.171 Octobercms October 1.0.172 Octobercms October 1.0.173 Octobercms October 1.0.174 Octobercms October 1.0.175 Octobercms October 1.0.176 Octobercms October 1.0.178 Octobercms October 1.0.179 Octobercms October 1.0.180 Octobercms October 1.0.181 Octobercms October 1.0.182 Octobercms October 1.0.183 Octobercms October 1.0.184 Octobercms October 1.0.185 Octobercms October 1.0.186 Octobercms October 1.0.187 Octobercms October 1.0.191 Octobercms October 1.0.192 Octobercms October 1.0.199 Octobercms October 1.0.205 Octobercms October 1.0.206 Octobercms October 1.0.209 Octobercms October 1.0.210 Octobercms October 1.0.211 Octobercms October 1.0.214 Octobercms October 1.0.215 Octobercms October 1.0.216 Octobercms October 1.0.217 Octobercms October 1.0.218 Octobercms October 1.0.220 Octobercms October 1.0.221 Octobercms October 1.0.222 Octobercms October 1.0.224 Octobercms October 1.0.225 Octobercms October 1.0.226 Octobercms October 1.0.227 Octobercms October 1.0.228 Octobercms October 1.0.229 Octobercms October 1.0.236 Octobercms October 1.0.239 Octobercms October 1.0.245 Octobercms October 1.0.246 Octobercms October 1.0.247 Octobercms October 1.0.249 Octobercms October 1.0.250 Octobercms October 1.0.252 Octobercms October 1.0.258 Octobercms October 1.0.260 Octobercms October 1.0.266 Octobercms October 1.0.267 Octobercms October 1.0.268 Octobercms October 1.0.269 Octobercms October 1.0.270 Octobercms October 1.0.271 Octobercms October 1.0.272 Octobercms October 1.0.273 Octobercms October 1.0.274 Octobercms October 1.0.275 Octobercms October 1.0.276 Octobercms October 1.0.277 Octobercms October 1.0.278 Octobercms October 1.0.279 Octobercms October 1.0.280 Octobercms October 1.0.283 Octobercms October 1.0.284 Octobercms October 1.0.287 Octobercms October 1.0.289 Octobercms October 1.0.290 Octobercms October 1.0.291 Octobercms October 1.0.292 Octobercms October 1.0.293 Octobercms October 1.0.295 Octobercms October 1.0.296 Octobercms October 1.0.297 Octobercms October 1.0.298 Octobercms October 1.0.299 Octobercms October 1.0.300 Octobercms October 1.0.301 Octobercms October 1.0.304 Octobercms October 1.0.305 Octobercms October 1.0.309 Octobercms October 1.0.310 Octobercms October 1.0.313 Octobercms October 1.0.316 Octobercms October 1.0.317 Octobercms October 1.0.318 Octobercms October 1.0.319 Octobercms October 1.0.320 Octobercms October 1.0.321 Octobercms October 1.0.322 Octobercms October 1.0.323 Octobercms October 1.0.324 Octobercms October 1.0.325 Octobercms October 1.0.326 Octobercms October 1.0.327 Octobercms October 1.0.328 Octobercms October 1.0.329 Octobercms October 1.0.330 Octobercms October 1.0.331 Octobercms October 1.0.332 Octobercms October 1.0.333 Octobercms October 1.0.334 Octobercms October 1.0.335 Octobercms October 1.0.336 Octobercms October 1.0.337 Octobercms October 1.0.338 Octobercms October 1.0.339 Octobercms October 1.0.340 Octobercms October 1.0.341 Octobercms October 1.0.342 Octobercms October 1.0.343 Octobercms October 1.0.344 Octobercms October 1.0.345 Octobercms October 1.0.346 Octobercms October 1.0.347 Octobercms October 1.0.348 Octobercms October 1.0.349 Octobercms October 1.0.350 Octobercms October 1.0.351 Octobercms October 1.0.352 Octobercms October 1.0.353 Octobercms October 1.0.354 Octobercms October 1.0.355 Octobercms October 1.0.356 Octobercms October 1.0.357 Octobercms October 1.0.358 Octobercms October 1.0.359 Octobercms October 1.0.360 Octobercms October 1.0.361 Octobercms October 1.0.362 Octobercms October 1.0.363 Octobercms October 1.0.364 Octobercms October 1.0.365 Octobercms October 1.0.366 Octobercms October 1.0.367 Octobercms October 1.0.368 Octobercms October 1.0.369 Octobercms October 1.0.370 Octobercms October 1.0.371 Octobercms October 1.0.372 Octobercms October 1.0.373 Octobercms October 1.0.374 Octobercms October 1.0.375 Octobercms October 1.0.376 Octobercms October 1.0.377 Octobercms October 1.0.378 Octobercms October 1.0.379 Octobercms October 1.0.380 Octobercms October 1.0.381 Octobercms October 1.0.382 Octobercms October 1.0.383 Octobercms October 1.0.384 Octobercms October 1.0.385 Octobercms October 1.0.386 Octobercms October 1.0.387 Octobercms October 1.0.388 Octobercms October 1.0.389 Octobercms October 1.0.390 Octobercms October 1.0.391 Octobercms October 1.0.392 Octobercms October 1.0.393 Octobercms October 1.0.394 Octobercms October 1.0.395 Octobercms October 1.0.396 Octobercms October 1.0.397 Octobercms October 1.0.398 Octobercms October 1.0.399 Octobercms October 1.0.400 Octobercms October 1.0.401 Octobercms October 1.0.402 Octobercms October 1.0.403 Octobercms October 1.0.404 Octobercms October 1.0.405 Octobercms October 1.0.406 Octobercms October 1.0.407 Octobercms October 1.0.408 Octobercms October 1.0.409 Octobercms October 1.0.410 Octobercms October 1.0.411 Octobercms October 1.0.412 Octobercms October 1.0.413 Octobercms October 1.0.414 Octobercms October 1.0.415 Octobercms October 1.0.416 Octobercms October 1.0.417 Octobercms October 1.0.418 Octobercms October 1.0.419 Octobercms October 1.0.420 Octobercms October 1.0.421 Octobercms October 1.0.422 Octobercms October 1.0.423 Octobercms October 1.0.424 Octobercms October 1.0.425 Octobercms October 1.0.426 Octobercms October 1.0.427 Octobercms October 1.0.428 Octobercms October 1.0.429 Octobercms October 1.0.430 Octobercms October 1.0.431 Octobercms October 1.0.432 Octobercms October 1.0.433 Octobercms October 1.0.434 Octobercms October 1.0.435 Octobercms October 1.0.436 Octobercms October 1.0.437 Octobercms October 1.0.438 Octobercms October 1.0.439 Octobercms October 1.0.440 Octobercms October 1.0.441 Octobercms October 1.0.442 Octobercms October 1.0.443 Octobercms October 1.0.444 Octobercms October 1.0.445 Octobercms October 1.0.446 Octobercms October 1.0.447 Octobercms October 1.0.448 Octobercms October 1.0.449 Octobercms October 1.0.450 Octobercms October 1.0.451 Octobercms October 1.0.452 Octobercms October 1.0.453 Octobercms October 1.0.454 Octobercms October 1.0.455 Octobercms October 1.0.456 Octobercms October 1.0.457 Octobercms October 1.0.458 Octobercms October 1.0.459 Octobercms October 1.0.460 Octobercms October 1.0.461 Octobercms October 1.0.462 Octobercms October 1.0.463 Octobercms October 1.0.464 Octobercms October 1.0.465 Octobercms October 1.0.466 Octobercms October 1.0.467 Octobercms October 1.0.468 Octobercms October 1.0.469 Octobercms October 1.0.470 Octobercms October 1.0.471 Octobercms October 1.0.472 Octobercms October 1.0.473 Octobercms October 1.0.474 Octobercms October 1.0.475 Octobercms October 1.0.476 Octobercms October 1.1.0 Octobercms October 1.1.1	373

Common Weakness Enumeration (CWE)

CWE-644 - Improper Neutralization of HTTP Headers for Scripting Syntax

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References