PT-2020-16324 · Fuel Cms · Fuel Cms

Dominique Righetto · Published 2020-11-04 · Updated 2021-07-21 · CVE-2020-26167

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FUEL CMS versions 11.4.12 and earlier

Description The page preview feature in FUEL CMS allows an anonymous user to take complete ownership of any account, including an administrator account.

Recommendations For versions 11.4.12 and earlier, as a temporary workaround, consider disabling the page preview feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-26167

Affected Products

Fuel Cms

References · 8

• https://thedaylightstudio.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26167 · Vendor Advisory
• https://getfuelcms.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26167 · Security Note
• https://excellium-services.com/cert-xlm-advisory/cve-2020-26167 · Note
• https://github.com/daylightstudio/FUEL-CMS · Note
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-26167 · Note
• https://t.me/cvenotify/5120 · Telegram Post