CVE-2024-24764

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-24764
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24764.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-24764
Aliases
Published
2024-06-26T00:02:49Z
Modified
2025-10-21T02:37:11Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:L CVSS Calculator
Summary
October Open Redirect for Administrator Accounts
Details

October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (october://) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability has been patched in version 3.5.15.

References

Affected packages

Git /

Affected ranges

Database specific

unresolved_versions

[
    {
        "type": "",
        "events": [
            {
                "introduced": "3.2"
            },
            {
                "fixed": "3.5.15"
            }
        ]
    }
]