Skip to content

Latest commit

 

History

History
15 lines (9 loc) · 828 Bytes

README.md

File metadata and controls

15 lines (9 loc) · 828 Bytes
Raw

CVE-2021-32648

Patch your code for October CMS Auth Bypass CVE-2021-32648

Instructions

  1. Open the file vendor/october/rain/src/Auth/Models/User.php
  2. Perform the patch found in these diff notes
  3. Save the file

Overview

You are converting a loose comparison to a strict comparison by replacing two (2) equal signs == with three (3) equal signs ===. This blocks the attack vector as described in CVE-2021-32648 and also CVE-2021-29487.

This issue has been patched in October CMS Build 472 (v1.0.472+) and v1.1.5+. This issue does not affect v2.0.0+.