CVE-2024-24764CWE-601

October Open Redirect for Administrator Accounts

Low · published June 26, 2024

CVSS v3.1
3.5
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability has been patched in version 3.5.15.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.4th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2024-06-26T00:02Z
EPSS history
Timeline
  • 26 JUN 00:02Z
    October Open Redirect for Administrator Accounts
    cvelistv5