CVE-2021-32648

Timeline

Detection, updates, and resolution for this record.

1. Aug 26, 2021 · Catalog

   Detected

   octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

2. Jan 18, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Feb 1, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

Affected

• cpe octobercms/octoberversion unspecified
• cpe octobercms/october1.0.471
• vendor October CMS October CMSversion unspecified

Sources

• CISA KEVCVE-2021-32648

  In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.

  cisa.gov
• CVE.orgCVE-2021-32648

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2021-32648

  30-day exploitation probability 90.4%

  first.org
• NIST NVDCVE-2021-32648

  octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and

  nvd.nist.gov

References

• Patch · github.com
• Patch · github.com
• Patch · github.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov