{"schema":"threatline.record/2","record":{"id":"CVE-2021-32648","aliases":["GHSA-mxr5-mc97-63rc"],"summary":"October CMS Improper Authentication","details":"In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.","categories":["Libraries & packages"],"product":"October CMS","vendor":"October CMS","ecosystem":"Packagist","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-32648","source_modified_at":"2025-10-21T23:25:36.099Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"october","vendor":"octobercms","versions":[{"status":"affected","version":">= 1.0.471, < 1.0.472"},{"status":"affected","version":">= 1.1.1, < 1.1.5"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc","source_modified_at":"2022-02-20T02:02:36Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"composer","name":"october/system"},"range":"1.0.471, 1.1.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mxr5-mc97-63rc","source_modified_at":"2026-07-08T06:00:14.285076028Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"october/system","purl":"pkg:composer/october/system"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.472"}],"type":"ECOSYSTEM"}],"versions":["v1.0.319","v1.0.320","v1.0.321","v1.0.322","v1.0.323","v1.0.324","v1.0.325","v1.0.326","v1.0.327","v1.0.328","v1.0.329","v1.0.330","v1.0.331","v1.0.332","v1.0.333","v1.0.334","v1.0.335","v1.0.336","v1.0.337","v1.0.338","v1.0.339","v1.0.340","v1.0.341","v1.0.342","v1.0.343","v1.0.344","v1.0.345","v1.0.346","v1.0.347","v1.0.348","v1.0.349","v1.0.350","v1.0.351","v1.0.352","v1.0.353","v1.0.354","v1.0.355","v1.0.356","v1.0.357","v1.0.358","v1.0.359","v1.0.360","v1.0.361","v1.0.362","v1.0.363","v1.0.364","v1.0.365","v1.0.366","v1.0.367","v1.0.368"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mxr5-mc97-63rc","source_modified_at":"2026-07-08T06:00:14.285076028Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"october/system","purl":"pkg:composer/october/system"},"ranges":[{"events":[{"introduced":"1.1.1"},{"fixed":"1.1.5"}],"type":"ECOSYSTEM"}],"versions":["v1.1.1","v1.1.2","v1.1.3","v1.1.4"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc","source_modified_at":"2022-02-20T02:02:36Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"composer","name":"october/system"},"version":"1.0.472"},{"source":"GitHub Advisory Database","source_url":"https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc","source_modified_at":"2022-02-20T02:02:36Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"composer","name":"october/system"},"version":"1.1.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mxr5-mc97-63rc","source_modified_at":"2026-07-08T06:00:14.285076028Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"october/system","purl":"pkg:composer/october/system"},"version":"1.0.472"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mxr5-mc97-63rc","source_modified_at":"2026-07-08T06:00:14.285076028Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Packagist","name":"october/system","purl":"pkg:composer/october/system"},"version":"1.1.5"}],"cvss":8.2,"severity":"High","kev":{"listed":true,"date_added":"2022-01-18","due_date":"2022-02-01","required_action":"Apply updates per vendor instructions.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.90418,"percentile":0.99803,"score_date":"2026-10-23"},"published_at":"2021-08-26T19:00:12.000Z","modified_at":"2026-07-08T06:00:14.285076028Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2021-32648","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:25:36.099Z"},{"source":"GitHub Advisory Database","url":"https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc","fetched_at":"2026-10-23T21:10:45.942435Z","source_modified_at":"2022-02-20T02:02:36Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-mxr5-mc97-63rc","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-07-08T06:00:14.285076028Z"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32648.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-32648","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","GitHub Advisory Database","OSV","Nuclei","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32648","source":"CISA KEV"},{"source":"CVE List","url":"https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32648","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"partial","assessed_at":"2025-02-06T19:37:19.296739Z"},"exploits":[{"kind":"Scanner template","name":"OctoberCMS - Account Takeover","source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32648.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-07-08T06:00:14.285076028Z","content_hash":"bd76ab2c6683baeeb9d3f9455f0f8661f55d9999bdd2f7e5fa11979865b05a95"}}