200 lines
8.1 KiB
JSON
200 lines
8.1 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-79989",
|
||
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Hackrate",
|
||
"dateReserved": "2026-08-25T16:39:03.171Z",
|
||
"datePublished": "2026-09-02T14:11:02.784Z",
|
||
"dateUpdated": "2026-09-02T17:51:42.963Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
|
||
"shortName": "Hackrate",
|
||
"dateUpdated": "2026-09-02T14:11:02.784Z"
|
||
},
|
||
"title": "Arbitrary user password reset leading to administrator account takeover",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"cweId": "CWE-285",
|
||
"description": "CWE-285 Improper Authorization",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "craftcms",
|
||
"product": "cms",
|
||
"collectionURL": "https://packagist.org",
|
||
"packageName": "craftcms/cms",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "5.0.0-RC1",
|
||
"lessThan": "5.10.8",
|
||
"versionType": "semver"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"operator": "OR",
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.0.0-rc1",
|
||
"versionEndExcluding": "5.10.8"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has <code>Edit users</code> permission (which doesn’t allow changing others’ passwords) and lacks <code>Administrate users</code> permission (which is required to change others’ passwords).<br>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH",
|
||
"tags": [
|
||
"third-party-advisory",
|
||
"technical-description",
|
||
"mitigation"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://github.com/craftcms/cms/releases/tag/5.10.8",
|
||
"tags": [
|
||
"release-notes"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://github.com/craftcms/cms",
|
||
"tags": [
|
||
"product"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://github.com/advisories/GHSA-p8x7-9vfw-p7vc",
|
||
"tags": [
|
||
"third-party-advisory"
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
],
|
||
"cvssV4_0": {
|
||
"attackVector": "NETWORK",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "NONE",
|
||
"privilegesRequired": "LOW",
|
||
"userInteraction": "NONE",
|
||
"vulnConfidentialityImpact": "HIGH",
|
||
"subConfidentialityImpact": "NONE",
|
||
"vulnIntegrityImpact": "HIGH",
|
||
"subIntegrityImpact": "NONE",
|
||
"vulnAvailabilityImpact": "HIGH",
|
||
"subAvailabilityImpact": "NONE",
|
||
"exploitMaturity": "NOT_DEFINED",
|
||
"Safety": "NOT_DEFINED",
|
||
"Automatable": "NOT_DEFINED",
|
||
"Recovery": "NOT_DEFINED",
|
||
"valueDensity": "NOT_DEFINED",
|
||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||
"providerUrgency": "NOT_DEFINED",
|
||
"version": "4.0",
|
||
"baseSeverity": "HIGH",
|
||
"baseScore": 8.7,
|
||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
|
||
}
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Mohammed Hesham (@he4am)",
|
||
"type": "reporter"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"value": "Hackrate",
|
||
"type": "coordinator"
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "GHSA-p8x7-9vfw-p7vc",
|
||
"discovery": "UNKNOWN"
|
||
},
|
||
"x_generator": {
|
||
"engine": "Vulnogram 1.0.4"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-09-02T17:51:36.553736Z",
|
||
"id": "CVE-2026-79989",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-09-02T17:51:42.963Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |