UpHeron
All vulnerabilities

Servers and applications

CVE-2017-16244

Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.

Severity
High 8.8
Published
1 Nov 2017
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2% in the next 30 daysHigher than 80% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Cross-site request forgery (CWE-352)
Attack
Over the network · No login needed · Needs someone to click or open something
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Sources
NVD

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • Version 1.0.426

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-16244
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-16244