CVE-2019-17605

A mass assignment vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to take over another candidate's account (by also exploiting CVE-2019-17604) via a modified candidate id and an additional password parameter. The outcome is that the password of this other candidate is changed.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
VendorProductVersion
eyecommseyecms
𝑥
≤ 2019-10-15
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.eyecomms.com/Products/eyeCMS.html
https://gist.github.com/AhMyth/6d9c5e15d943dd092ccca19fca8d5d37
http://www.eyecomms.com/Products/eyeCMS.html
https://gist.github.com/AhMyth/6d9c5e15d943dd092ccca19fca8d5d37