CVE-2024-25637

October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a proxy interception tool. This issue has been patched in version 3.5.15.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563	Vendor Advisory
https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*

History

29 Sep 2025, 14:09

Type	Values Removed	Values Added
CPE		cpe:2.3:a:octobercms:october::::::::
First Time		Octobercms october Octobercms
References	~~() https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563 -~~	() https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563 - Vendor Advisory

Information

Published : 2024-06-26 16:15

Updated : 2025-09-29 14:09

NVD link : CVE-2024-25637

Mitre link : CVE-2024-25637

CVE.ORG link : CVE-2024-25637

JSON object : View

Products Affected

octobercms

october

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-25637", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-06-26T16:15:10.910", "references": [{"url": "https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a proxy interception tool. This issue has been patched in version 3.5.15.\n"}, {"lang": "es", "value": "October es una plataforma CMS autohospedada basada en Laravel PHP Framework. El encabezado X-October-Request-Handler no sanitiza el nombre del controlador AJAX y permite que se refleje HTML sin escape. No hay ning\u00fan impacto ya que esta vulnerabilidad no se puede explotar mediante interacciones normales del navegador. Este valor sin escape solo es detectable cuando se utiliza una herramienta de interceptaci\u00f3n de proxy. Este problema se solucion\u00f3 en la versi\u00f3n 3.5.15."}], "lastModified": "2025-09-29T14:09:16.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C52BE43-5841-46A0-B56D-F7043B9FE9BB", "versionEndExcluding": "3.5.15", "versionStartIncluding": "3.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}