// For flags

CVE-2018-1000158

 

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url'] . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack.

cmsmadesimple 2.2.7 contiene una vulnerabilidad de control de acceso incorrecto en la función send_recovery_email en la línea "$url = $config['admin_url'] . '/login.php?recoverme=' . $code;" que puede resultar en el envenenamiento del restablecimiento de la contraseña del administrador, específicamente una URL de restablecimiento que señala a un servidor controlado por el atacante que se puede crear empleando un ataque de cabecera host.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-03-25 CVE Reserved
  • 2018-04-18 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
References (1)
URL Tag Source
URL Date SRC
http://dev.cmsmadesimple.org/bug/view/11762 2024-08-05
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cmsmadesimple
Search vendor "Cmsmadesimple"
 Cms Made Simple
Search vendor "Cmsmadesimple" for product "Cms Made Simple"
 2.2.7
Search vendor "Cmsmadesimple" for product "Cms Made Simple" and version "2.2.7"
-
Affected