Access Control Vulnerability in Statamic Framework by Statamic
CVE-2017-11422

8.8HIGH

Key Information:

Vendor

Statamic

Status
Statamic
Vendor
CVE Published:
24 July 2017

What is CVE-2017-11422?

The Statamic framework versions prior to 2.6.0 are prone to an access control vulnerability that fails to correctly validate user permissions when executing specific methods from a user's class. This oversight affects crucial functions such as resetting passwords, creating new accounts, and establishing new roles, potentially allowing unauthorized users to exploit these capabilities.

References

https://gist.github.com/rambo691/3714c8c09cf894d574d37c29...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.