CVEvulnerability
CVE-2017-5594
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-01-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-640
Description
An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.
Affected configurations
• pagekit pagekit (<= 1.0.10)
Related
Weakness · CWE (1)
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness
References
- http://www.securityfocus.com/bid/95806 Third Party Advisory, VDB Entry
- https://github.com/pagekit/pagekit/commit/e0454f9c037c427a5ff76a57e78dbf8cc00c268b Patch
- https://securelayer7.net/download/pdf/SecureLayer7-Pentest-report-Pagekit-CMS.pdf Technical Description, Third Party Advisory
- https://securelayer7.net/download/poc/password-reset-vulnerability-exploit-ruby-pagekit-cms.rb.txt Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/41143/ Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/95806 Third Party Advisory, VDB Entry
- https://github.com/pagekit/pagekit/commit/e0454f9c037c427a5ff76a57e78dbf8cc00c268b Patch
- https://securelayer7.net/download/pdf/SecureLayer7-Pentest-report-Pagekit-CMS.pdf Technical Description, Third Party Advisory
- https://securelayer7.net/download/poc/password-reset-vulnerability-exploit-ruby-pagekit-cms.rb.txt Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/41143/ Exploit, Third Party Advisory, VDB Entry