CVE-2024-24764
October System module has an Open Redirect for Administrator Accounts
Description
### Impact This advisory affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user. ### Patches This issue has been patched in v3.5.15. ### References Credits to: - [Benzetaa](https://github.com/benzetaa/) ### For more information If you have any questions or comments about this advisory: * Email us at [[email protected]](mailto:[email protected])
How to fix CVE-2024-24764
To remediate CVE-2024-24764, upgrade the affected package to a fixed version below.
- —upgrade to 3.5.15 or later
Is CVE-2024-24764 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 3.2, < 3.5.15
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | LOW3.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:L |