{
"id": "GHSA-7ggw-h8pp-r95r",
"aliases": [
"CVE-2021-3311"
],
"details": "### Impact\nWhen logging out, the session ID was not invalidated. This is not a problem while the user is logged out, but as soon as the user logs back in the old session ID would be valid again; which means that anyone that gained access to the old session cookie would be able to act as the logged in user. This is not a major concern for the majority of cases, since it requires a malicious party gaining access to the session cookie in the first place, but nevertheless has been fixed.\n\n### Patches\nIssue has been patched in Build 472 (v1.0.472) and v1.1.2.\n\n### Workarounds\nApply https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 to your installation manually if unable to upgrade to Build 472 or v1.1.2.\n\n### References\n- Reported by Anisio (Brazilian Information Security Analyst)\n- http://cve.circl.lu/cve/CVE-2021-3311\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [[email protected] ](mailto:[email protected] )\n\n### Threat assessment:\n<img width=\"699\" alt=\"Screen Shot 2021-02-07 at 11 50 35 PM\" src=\"https://user-images.githubusercontent.com/7253840/107180881-51eaf000-699f-11eb-8828-333128faf2a6.png\">",
"summary": "October CMS Session ID not invalidated after logout",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.472"
}
]
}
],
"package": {
"name": "october/rain",
"ecosystem": "Packagist"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.1.0"
},
{
"fixed": "1.1.2"
}
]
}
],
"package": {
"name": "october/rain",
"ecosystem": "Packagist"
}
}
],
"modified": "2023-09-07T17:47:26Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"published": "2021-02-10T02:32:35Z",
"references": [
{
"url": "https://github.com/octobercms/october/security/advisories/GHSA-7ggw-h8pp-r95r",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3311",
"type": "ADVISORY"
},
{
"url": "https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024",
"type": "WEB"
},
{
"url": "https://anisiosantos.me/october-cms-token-reactivation",
"type": "WEB"
},
{
"url": "https://octobercms.com/forum/chan/announcements",
"type": "WEB"
},
{
"url": "https://packagist.org/packages/october/rain",
"type": "WEB"
},
{
"url": "http://cve.circl.lu/cve/CVE-2021-3311",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"severity": "CRITICAL",
"github_reviewed": true,
"nvd_published_at": "2021-02-05T14:15:00Z",
"github_reviewed_at": "2021-02-10T02:30:45Z"
}
}