Access Restriction Bypass Affecting craftcms/cms Open this link in a new tab package, versions >=0.0.0
Exploit Maturity
Proof of concept
Attack Complexity
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-PHP-CRAFTCMSCMS-2812822
-
published
10 May 2022
-
disclosed
10 May 2022
-
credit
Sandro Einfeldt
Introduced: 10 May 2022
New CVE-2022-29933 Open this link in a new tabHow to fix?
There is no fixed version for craftcms/cms.
Overview
craftcms/cms is a content management system.
Affected versions of this package are vulnerable to Access Restriction Bypass which allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality.
Note: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).