VulnerabilityModified
CVE-2020-6949
A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3.
HIGH 8.8EPSS 1.28%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.28% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-269
- Affected
- hashbrowncms/hashbrown cms
- Source
- cve@mitre.org
References
- https://github.com/HashBrownCMS/hashbrown-cms/issues/327Exploit, Third Party Advisory
- https://github.com/HashBrownCMS/hashbrown-cms/issues/327Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.