GitHub Advisoryadvisory · npm

GHSA-jhq3-57xh-6643 Privilege Escalation due to Blind NoSQL Injection in flintcms

CRITICAL Published 2018-08-21 Modified 2021-09-14 Official page ↗
Aliases
CVE-2018-3783
Ecosystem
npm
Packages
flintcms
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• npm flintcms: < 1.1.10 → fixed in 1.1.10

Description

Versions of `flintcms` before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset. Recommendation Update to version 1.1.10 or later.

Related

Alias · CVE (1)

  • CVE-2018-3783 A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References