GitHub Advisoryadvisory · Packagist

GHSA-hh92-wg7v-8vfr Gleez CMS Vulnerability Allows Forced Browsing to Profile Page of Other Users

MEDIUM Published 2022-05-13 Modified 2024-04-25 Official page ↗
Aliases
CVE-2018-16704
Ecosystem
Packagist
Packages
gleez/cms
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-639
Reviewed
2024-04-25

Affected packages

• Packagist gleez/cms: <= 1.2.0 (no fix yet)

Description

An issue was discovered in Gleez CMS v1.2.0. Because of an Insecure Direct Object Reference vulnerability, it is possible for attackers (logged in users) to view profile page of other users, as demonstrated by navigating to `user/3` on `demo.gleezcms.org`.

Related

Alias · CVE (1)

  • CVE-2018-16704 An issue was discovered in Gleez CMS v1.2.0. vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References