CVE-2017-16244: CSRF
Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain handler postback variable.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16244?
CVE-2017-16244 has a medium severity rating due to its potential for account takeover via Cross-Site Request Forgery.
How do I fix CVE-2017-16244?
To fix CVE-2017-16244, update OctoberCMS to version 1.0.427 or later.
What is the impact of CVE-2017-16244 on my OctoberCMS site?
CVE-2017-16244 allows attackers to bypass CSRF protections, leading to unauthorized actions on behalf of authenticated users.
Which versions of OctoberCMS are affected by CVE-2017-16244?
CVE-2017-16244 affects OctoberCMS version 1.0.426 and below.
Is it safe to continue using OctoberCMS version 1.0.426 after CVE-2017-16244?
No, it is not safe to use OctoberCMS version 1.0.426 due to the identified vulnerability which can lead to account compromise.