CVE-2019-10014 - In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated

Back Back to CVE browser

MEDIUM

In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated

Published Mar 24, 2019

6.5

MEDIUM

CVSS 3.0

EPSS 1.09%

Description

In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (2)

https://blog.csdn.net/yalecaltech/article/details/88594388
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2078
Advisory

Link	Providers	Tags
https://blog.csdn.net/yalecaltech/article/details/88594388		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2078		Advisory