8.8high
CVE-2017-162441 exploit
October CMS CSRF
Also known as GHSA-vm6r-4p4v-232x
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 81%
Public exploits
1
Exploit-DB
Summary
Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.
Exploit prediction (EPSS)
1.98% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.
Exploits and detections
- EDB-43106 OctoberCMS 1.0.426 (Build 426) - Cross-Site Request Forgery · webapps · 2017-11-01
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | october/october | <1.0.427 | 1.0.427 |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- github.com /octobercms/october/commit/4a6e0e1e0e2c3facebc17e0db38c5b4d4cb05bd0 · x_refsource_CONFIRM, x_transferred
- exploit-db.com /exploits/43106/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-16244 · advisory
- github.com /octobercms/october · package
- exploit-db.com /exploits/43106 · web
Sources
- CVE List: CVE-2017-16244
- GitHub Advisory: GHSA-vm6r-4p4v-232x
- NVD: CVE-2017-16244
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.