UpHeron
All vulnerabilities

Servers and applications

CVE-2021-21265

Potential Host Header Poisoning on misconfigured servers

Severity
High 7.5
Published
10 Mar 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.1.2
Also known as
GHSA-xhfx-hgmf-v6vp
Sources
NVD, Project advisories (GitHub)

Description

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • Every version before 1.1.2
October CMSServers and applications · github:octobercms/october
  • Every version before 1.1.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-21265
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-21265
  • GitHub Advisory Database https://github.com/advisories/GHSA-xhfx-hgmf-v6vp
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp