CVE-2021-41126CWE-287

Deleted Admin Can Sign In to Admin Interface

High · published October 6, 2021

CVSS v3.1
7.2
EPSS
1%
Percentile
65.1
In the wild
Unconfirmed
What it is

October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01091 · 65.1th percentile
Weakness
CWE-287 · Improper Authentication
Published
2021-10-06T17:25Z
EPSS history
Timeline
  • 06 OCT 17:25Z
    Deleted Admin Can Sign In to Admin Interface
    cvelistv5