Authentication Bypass in October CMS Password Reset Enables Account Takeover
CISA: October CMS Improper Authentication
CVSS 3.1
9.1critical
EPSS
90%p100
Published
()
KEV added
AI analysis
October CMS, a content management system built on the Laravel PHP framework, contains an improper authentication flaw (CWE-287) in its october/system package: an attacker can initiate a password reset for any account and then submit a specially crafted request that bypasses the reset-code check, gaining access to that account without knowing the current password. The flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1: 9.1, critical), and takeover of a back-end administrator account would grant the attacker full control of the CMS's content, users, and configuration. Any October CMS deployment running october/system versions prior to Build 472 or v1.1.5 is affected. Exploitation is confirmed in the wild: CISA added CVE-2021-32648 to its Known Exploited Vulnerabilities Catalog on 2022-01-18 as part of a batch of 17 added flaws, requiring patching per vendor instructions, and EPSS assigns a 90.4% probability of exploitation within 30 days (100th percentile). CISA lists ransomware use as unknown, and no public proof-of-concept exploit is known.
What to do: Update October CMS to Build 472 or v1.1.5 (or later) following the vendor's update instructions; because the flaw is in CISA's KEV, patching is required for federal agencies. Organizations that cannot patch immediately should restrict network access to the CMS back end and audit recent password-reset requests, back-end logins, and account modifications for signs of takeover, rotating credentials for any accounts with unexpected resets.
Affected
October CMS (october/system package)
All versions prior to Build 472 and prior to v1.1.5; fixed in Build 472 and v1.1.5
Estimated exposure
large~ tens of thousands of installations (roughly 10,000-50,000 sites per public CMS usage trackers; a subset are internet-exposed) - estimate — Estimate based on public web-technology usage surveys, which have historically counted live October CMS sites in the tens of thousands; the provided CVE data contains no authoritative install or internet-exposed instance counts, so this is…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
Ukrainian government sites were defaced via OctoberCMS CVE-2021-32648 while Microsoft-attributed actor DEV-0586 deployed destructive WhisperGate malware.
Unit 42 tracks January 2022 attacks against Ukrainian government websites that were defaced or made inaccessible, which Ukraine attributed to Russia. Attackers exploited CVE-2021-32648, an account takeover flaw in OctoberCMS prior to 1.0.472, by submitting a boolean true as the password reset code to bypass validation. Separately, WhisperGate malware, attributed by Microsoft to DEV-0586, disabled Windows Defender and corrupted files across multiple Ukrainian organizations, using a ransomware-appearing first stage and an HTTPS-beaconing second stage with LOLBINs and anti-analysis techniques.