PT-2020-19302 · Hashbrown · Hashbrown Cms

Ufo009Eo · Published 2020-01-13 · Updated 2020-01-17 · CVE-2020-6949

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions through 1.3.3

Description A privilege escalation issue was found in the postUser function. This allows an editor user to change the password hash of an admin user's account or reconfigure the account.

Recommendations For HashBrown CMS versions through 1.3.3, consider restricting access to the postUser function until a fix is available. As a temporary workaround, limit the privileges of editor users to prevent them from modifying admin accounts.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-6949

Affected Products

Hashbrown Cms

References · 3

• 🔥 https://github.com/HashBrownCMS/hashbrown-cms/issues/327 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-6949 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6949 · Vendor Advisory