October におけるHTTP ヘッダのスクリプト構文の不適切な無効化に関する脆弱性
| Title |
October におけるHTTP ヘッダのスクリプト構文の不適切な無効化に関する脆弱性
|
| Summary |
October には、HTTP ヘッダのスクリプト構文の不適切な無効化に関する脆弱性が存在します。
|
| Possible impacts |
情報を改ざんされる可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
Jan. 5, 2021, midnight |
| Registration Date |
Nov. 24, 2021, 12:04 p.m. |
| Last Update |
Nov. 24, 2021, 12:04 p.m. |
|
CVSS3.0 : 重要
|
| Score |
7.5
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
|
CVSS2.0 : 警告
|
| Score |
4.3
|
| Vector |
AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected System
| OctoberCMS |
|
October 1.1.2 未満
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2021年11月24日]
掲載 |
Nov. 24, 2021, 12:04 p.m. |
NVD Vulnerability Information
CVE-2021-21265
| Summary |
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.
|
| Publication Date |
March 11, 2021, 7:15 a.m. |
| Registration Date |
March 11, 2021, 10:02 a.m. |
| Last Update |
Nov. 21, 2024, 2:47 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* |
|
|
|
1.1.2 |
Related information, measures and tools
Common Vulnerabilities List