GHSA-7ggw-h8pp-r95r

Source

https://github.com/advisories/GHSA-7ggw-h8pp-r95r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/02/GHSA-7ggw-h8pp-r95r/GHSA-7ggw-h8pp-r95r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7ggw-h8pp-r95r

Aliases

CVE-2021-3311

Published

2021-02-10T02:32:35Z

Modified

2024-02-16T08:20:41Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

October CMS Session ID not invalidated after logout

Details

Impact

When logging out, the session ID was not invalidated. This is not a problem while the user is logged out, but as soon as the user logs back in the old session ID would be valid again; which means that anyone that gained access to the old session cookie would be able to act as the logged in user. This is not a major concern for the majority of cases, since it requires a malicious party gaining access to the session cookie in the first place, but nevertheless has been fixed.

Patches

Issue has been patched in Build 472 (v1.0.472) and v1.1.2.

Workarounds

Apply https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 to your installation manually if unable to upgrade to Build 472 or v1.1.2.

References

Reported by Anisio (Brazilian Information Security Analyst)
http://cve.circl.lu/cve/CVE-2021-3311

For more information

If you have any questions or comments about this advisory:

Email us at hello@octobercms.com

Threat assessment:

Database specific

{
    "cwe_ids":  [
        "CWE-613"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-02-10T02:30:45Z",
    "nvd_published_at":  "2021-02-05T14:15:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Packagist / october/rain

Package

Name: october/rain
Purl: pkg:composer/october/rain

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.472

Affected versions

v1.*

v1.0.319

v1.0.320

v1.0.321

v1.0.322

v1.0.323

v1.0.324

v1.0.325

v1.0.326

v1.0.327

v1.0.328

v1.0.329

v1.0.330

v1.0.331

v1.0.332

v1.0.333

v1.0.334

v1.0.335

v1.0.336

v1.0.337

v1.0.338

v1.0.339

v1.0.340

v1.0.341

v1.0.342

v1.0.343

v1.0.344

v1.0.345

v1.0.346

v1.0.347

v1.0.348

v1.0.349

v1.0.350

v1.0.351

v1.0.352

v1.0.353

v1.0.354

v1.0.355

v1.0.356

v1.0.357

v1.0.358

v1.0.359

v1.0.360

v1.0.361

v1.0.362

v1.0.363

v1.0.364

v1.0.365

v1.0.366

v1.0.367

v1.0.368

v1.0.369

v1.0.370

v1.0.371

v1.0.372

v1.0.373

v1.0.374

v1.0.375

v1.0.376

v1.0.377

v1.0.378

v1.0.379

v1.0.380

v1.0.381

v1.0.382

v1.0.383

v1.0.384

v1.0.385

v1.0.386

v1.0.387

v1.0.388

v1.0.389

v1.0.390

v1.0.391

v1.0.392

v1.0.393

v1.0.394

v1.0.395

v1.0.396

v1.0.397

v1.0.398

v1.0.399

v1.0.400

v1.0.401

v1.0.402

v1.0.403

v1.0.404

v1.0.405

v1.0.406

v1.0.407

v1.0.408

v1.0.409

v1.0.410

v1.0.411

v1.0.412

v1.0.413

v1.0.414

v1.0.415

v1.0.416

v1.0.417

v1.0.418

v1.0.419

v1.0.420

v1.0.421

v1.0.422

v1.0.423

v1.0.424

v1.0.425

v1.0.426

v1.0.427

v1.0.428

v1.0.429

v1.0.430

v1.0.431

v1.0.432

v1.0.433

v1.0.434

v1.0.435

v1.0.436

v1.0.437

v1.0.438

v1.0.439

v1.0.440

v1.0.441

v1.0.442

v1.0.443

v1.0.444

v1.0.445

v1.0.446

v1.0.447

v1.0.448

v1.0.449

v1.0.450

v1.0.451

v1.0.452

v1.0.453

v1.0.454

v1.0.455

v1.0.456

v1.0.457

v1.0.458

v1.0.459

v1.0.460

v1.0.461

v1.0.462

v1.0.463

v1.0.464

v1.0.465

v1.0.466

v1.0.467

v1.0.468

v1.0.469

v1.0.470

v1.0.471

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/02/GHSA-7ggw-h8pp-r95r/GHSA-7ggw-h8pp-r95r.json"