CVE-2024-24764
October System module has an Open Redirect for Administrator Accounts
Impact
### Impact This advisory affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user. ### Patches This issue has been patched in v3.5.15. ### References Credits to: - [Benzetaa](https://github.com/benzetaa/) ### For more information If you have any questions or comments about this advisory: * Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | october/system | >= 3.2, < 3.5.15 | 3.5.15 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Octobercms | October | from 3.2.0 before 3.5.15 |