Описание
profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions, via modified values to register.php.
Ссылки
- Broken Link
- Third Party AdvisoryVDB Entry
- ExploitThird Party AdvisoryVDB Entry
- Broken Link
- Third Party AdvisoryVDB Entry
- ExploitThird Party AdvisoryVDB Entry
Уязвимые конфигурации
Конфигурация 1Версия до 2 (включая)
cpe:2.3:a:extcalendar_project:extcalendar:*:*:*:*:*:*:*:*
EPSS
Процентиль: 92%
0.07467
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-522
Связанные уязвимости
CVSS3: 9.8
github
почти 4 года назад
profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions, via modified values to register.php.
EPSS
Процентиль: 92%
0.07467
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-522