CVE-2020-26167

Опубликовано: 04 нояб. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.

Ссылки

https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-26167
https://excellium-services.com/cert-xlm-advisory/cve-2020-26167/
Third Party Advisory
https://github.com/daylightstudio/FUEL-CMS/
Third Party Advisory
https://thedaylightstudio.com/
Vendor Advisory
https://www.getfuelcms.com/
Product
Vendor Advisory
https://excellium-services.com/cert-xlm-advisory/cve-2020-26167/
Third Party Advisory
https://github.com/daylightstudio/FUEL-CMS/
Third Party Advisory
https://thedaylightstudio.com/
Vendor Advisory
https://www.getfuelcms.com/
Product
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:thedaylightstudio:fuel_cms:*:*:*:*:*:*:*:*

Версия до 1.4.12 (включая)

EPSS

Процентиль: 86%

0.02953

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-xqh9-89v8-g968