CVE-2024-24764 - CVE House
Back to Database
Status published Low CVE-2024-24764

October Open Redirect for Administrator Accounts

Vulnerability Description

October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability has been patched in version 3.5.15.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-24764

Credits & Attribution

No credits recorded in the NVD database.

References

More from octobercms

View All →
CVE-2025-61676
October CMS Vulnerable to Stored XSS via Branding Styles
Medium 6.1
CVE-2025-61674
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
Medium 6.1
CVE-2024-51991
October CMS Allows Unprotected SVG Rename in Media Manager
Low 1.1
CVE-2024-25637
Reflected XSS via X-October-Request-Handler Header
Low 3.1
CVE-2023-44383
October CMS stored XSS by authenticated backend user with improper configuration
Medium 5.4

Affected Vendor

Affected Software

october
Vulnerable Versions:
>= 3.2, < 3.5.15

Timeline

Official Publish: June 26th, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:L

Weaknesses (CWE)

CWE-601

MITRE ATT&CK TTPs

T1566 Phishing
Initial Access
T1204 User Execution
Execution
T1071 Application Layer Protocol
Command and Control
T1189 Drive-by Compromise
Initial Access
T1036 Masquerading
Defense Evasion