PT-2021-11869 · WordPress · Aam Advanced Access Manager

Published 2021-01-01 · Updated 2024-01-05 · CVE-2020-35935

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Advanced Access Manager plugin versions prior to 6.6.2 for WordPress

Description: The issue allows privilege escalation on profile updates via the aam user roles POST parameter if Multiple Role support is enabled. The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.

Recommendations: For versions prior to 6.6.2, update to version 6.6.2 or later to resolve the issue. As a temporary workaround, consider disabling the Multiple Role support feature until a patch is available. Restrict access to profile updates to minimize the risk of exploitation. Avoid using the aam user roles parameter in profile updates until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2020-35935

Affected Products

Aam Advanced Access Manager

References · 6

• 🔥 https://wordfence.com/blog/2020/08/high-severity-vulnerability-patched-in-advanced-access-manager · Exploit
• https://osv.dev/vulnerability/CVE-2020-35935 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35935 · Security Note
• https://t.me/cvenotify/66370 · Telegram Post
• https://t.me/cvenotify/8073 · Telegram Post
• https://t.me/cibsecurity/21500 · Telegram Post