CVE-2024-24764
Published: 26 June 2024
Summary
CVE-2024-24764 is a low-severity Open Redirect (CWE-601) vulnerability in Octobercms October. Its CVSS base score is 3.5 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Internal Spearphishing (T1534); ranked at the 27.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2165
Vulnerability details
October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external…
more
links, therefore allowing an open redirect outside the scope of the active host. This vulnerability has been patched in version 3.5.15.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The open redirect in the authenticated admin PageFinder schema allows a compromised or malicious admin to craft trusted-looking links that redirect other admins to external untrusted sites, facilitating internal spearphishing.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.