Unauthorized Access in ThinkCMF Version 5.1.7
CVE-2021-40616

6.5MEDIUM

Key Information:

Vendor

Thinkcmf

Status
Thinkcmf
Vendor
CVE Published:
14 June 2022

What is CVE-2021-40616?

ThinkCMF version 5.1.7 is prone to an unauthorized access vulnerability that allows attackers to change the password of the administrator account with ID 1. This exploit occurs through background user management group permissions, meaning that the attacker must have access to the user management functionalities to take control of administrative credentials. This vulnerability highlights the importance of robust user permission settings to prevent unauthorized modifications.

References

https://github.com/thinkcmf/thinkcmf/issues/722
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.