CVE-2021-3311

An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

参照URL

advisory octobercms.com
patch github.com
report anisiosantos.me