Skip to content
Fencer Vulns
medium 6.8

CVE-2021-21265 json

October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers

published 2021-03-10 5 y ago modified 2026-07-08 4 mo ago also GHSA-xhfx-hgmf-v6vp , EUVD-2021-0727

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
0
none known

Summary

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.

Patch / fix

  • packagist october/backend 1.1.2
  • octobercms october 1.1.2

Exploit prediction

1.75% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected packages

ecosystem package affected fixed in
packagist october/backend
<1.1.2
1.1.2

Affected products

  • octobercms october

Classification

Weakness
  • CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.