NVD Vulnerability Detail

CVE-2021-21265

Summary	October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.
Publication Date	March 11, 2021, 7:15 a.m.
Registration Date	March 11, 2021, 10:02 a.m.
Last Update	Nov. 21, 2024, 2:47 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:octobercms:october::::::::					1.1.2

Related information, measures and tools

No	URL	タグ
1	https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6	Patch Third Party Advisory
2	https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6	Patch Third Party Advisory
3	https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0	Patch Third Party Advisory
4	https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0	Patch Third Party Advisory
5	https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp	Patch Third Party Advisory
6	https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp	Patch Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

October におけるHTTP ヘッダのスクリプト構文の不適切な無効化に関する脆弱性

Title	October におけるHTTP ヘッダのスクリプト構文の不適切な無効化に関する脆弱性
Summary	October には、HTTP ヘッダのスクリプト構文の不適切な無効化に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 5, 2021, midnight
Registration Date	Nov. 24, 2021, 12:04 p.m.
Last Update	Nov. 24, 2021, 12:04 p.m.

Affected System

OctoberCMS

October 1.1.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-21265	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21265
National Vulnerability Database (NVD)
2	CVE-2021-21265	https://nvd.nist.gov/vuln/detail/CVE-2021-21265

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-644	https://cwe.mitre.org/data/definitions/644.html

ベンダー情報

No	Name	URL
GitHub
1	Add app.trustedHosts config and force host checks on password reset (#5423)	https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0
2	Add trusted hosts support to library (#549)	https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6
3	Potential Host Header Poisoning on misconfigured servers	https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp

Change Log

No	Changed Details	Date of change
1	[2021年11月24日] 掲載	Nov. 24, 2021, 12:04 p.m.