GitHub Advisoryadvisory · Packagist

GHSA-qv5j-rwq3-m823 ThinkAdmin Administrator cookies still working after password change

CRITICAL Published 2022-05-13 Modified 2024-04-24 Official page ↗
Aliases
CVE-2019-11018
Ecosystem
Packagist
Packages
zoujingli/thinkadmin
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2024-04-24

Affected packages

• Packagist zoujingli/thinkadmin: 4.0 (no fix yet)

Description

`application\admin\controller\User.php` in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.

Related

Alias · CVE (1)

  • CVE-2019-11018 application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References