CVE-2017-16244 - CVE House
Back to Database
Status published High CVE-2017-16244

Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426)...

Vulnerability Description

Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-16244

Credits & Attribution

No credits recorded in the NVD database.

References

More from octobercms

View All →
CVE-2025-61676
October CMS Vulnerable to Stored XSS via Branding Styles
Medium 6.1
CVE-2025-61674
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
Medium 6.1
CVE-2024-51991
October CMS Allows Unprotected SVG Rename in Media Manager
Low 1.1
CVE-2024-25637
Reflected XSS via X-October-Request-Handler Header
Low 3.1
CVE-2024-24764
October Open Redirect for Administrator Accounts
Low 3.5

Affected Vendor

Affected Software

october
Vulnerable Versions:
1.0.426

Timeline

Official Publish: November 1st, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.