CVE-2024-24764
The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host.
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability has been patched in version 3.5.15.
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.27% probability · 18th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-601
- Affected
- octobercms/october
- Source
- security-advisories@github.com
References
- https://github.com/octobercms/october/security/advisories/GHSA-v2vf-jv88-3fp5Third Party Advisory
- https://github.com/octobercms/october/security/advisories/GHSA-v2vf-jv88-3fp5Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.