CVE-2017-8916

Published: Jan 31, 2018Modified: Nov 21, 2024

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access.

Affected (4)

Products: Cisecurity: Cis Cat Pro Dashboard

Cisecurity

1 product

Cis Cat Pro Dashboard

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Cisecurity Cis Cat Pro Dashboard	Version 1.0.0
Cisecurity Cis Cat Pro Dashboard	Version 1.0.1
Cisecurity Cis Cat Pro Dashboard	Version 1.0.2
Cisecurity Cis Cat Pro Dashboard	Version 1.0.3

Related CWEs

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

References (2)

https://www.cisecurity.org/cis-security-updates/incorrect-access-control-cve-2017-8916/

Source: cve@mitre.org

Vendor Advisory

https://www.cisecurity.org/cis-security-updates/incorrect-access-control-cve-2017-8916/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.