Description

A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.

Remediation

References

https://hackerone.com/reports/386807

Related Vulnerabilities

CVE-2022-25878 Vulnerability in npm package protobufjs

CVE-2020-15813 Vulnerability in maven package org.graylog2:graylog2-server

CVE-2020-8203 Vulnerability in maven package org.webjars.npm:lodash

CVE-2013-2254 Vulnerability in maven package org.apache.sling:org.apache.sling.servlets.post

CVE-2022-24725 Vulnerability in npm package shescape

Severity

Critical

Classification

CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Patch Third Party Advisory