2 lines
3.2 KiB
JSON
2 lines
3.2 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*","matchCriteriaId":"C6BF448C-7017-428E-B9BF-40069ACD3990","versionEndIncluding":"1.0.471","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker."},{"lang":"es","value":"Se detectó un problema en October hasta el build 471. Reactiva una ID de una sesión anterior (que había sido no válida después de cerrar la sesión) una vez que se produce un nuevo inicio de sesión. NOTA: esto viola el comportamiento de autenticación del archivo Auth/Manager.php previsto pero, cierto es que, solo es relevante si un ID de sesión antiguo es conocido por el atacante"}],"id":"CVE-2021-3311","lastModified":"2026-06-17T04:04:55.230","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":6.8,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.6,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2021-02-05T14:15:19.153","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://anisiosantos.me/october-cms-token-reactivation"},{"source":"cve@mitre.org","tags":["Patch","Third Party Advisory"],"url":"https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://octobercms.com/forum/chan/announcements"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://anisiosantos.me/october-cms-token-reactivation"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://octobercms.com/forum/chan/announcements"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"nvd@nist.gov","type":"Primary"}]}
|