Low severityNVD Advisory· Published Mar 10, 2021· Updated May 29, 2025
October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers
CVE-2021-21265
Description
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
october/backendPackagist | < 1.1.2 | 1.1.2 |
Affected products
2- Range: < 1.1.2
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-xhfx-hgmf-v6vpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-21265ghsaADVISORY
- github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10dghsax_refsource_MISCWEB
- github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6ghsax_refsource_MISCWEB
- github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30ghsax_refsource_MISCWEB
- github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0ghsax_refsource_MISCWEB
- github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vpghsax_refsource_CONFIRMWEB
- packagist.org/packages/october/backendghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.