- Vendor / Project
- October CMS
- Product
- October CMS
- Date added
- Jan 18, 2022
- Due date
- Feb 1, 2022
- Known ransomware use
- Unknown
- CWEs
- CWE-287
Description
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
Required action
Apply updates per vendor instructions.