Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified user_id parameter. This is related to ajax_image_upload and ajax_resize_image.
References
Link | Resource |
---|---|
https://github.com/ultimatemember/ultimatemember/blob/627bbb0fae81ac34c60b43f0867eadcf8e1bc523/includes/core/class-files.php#L269 | Third Party Advisory |
https://github.com/ultimatemember/ultimatemember/blob/627bbb0fae81ac34c60b43f0867eadcf8e1bc523/includes/core/class-files.php#L310 | Third Party Advisory |
https://github.com/ultimatemember/ultimatemember/commit/249682559012734a4f7d71f52609b2f301ea55b1 | Patch Third Party Advisory |
https://wordpress.org/plugins/ultimate-member/#developers | Vendor Advisory |
https://wpvulndb.com/vulnerabilities/10041 | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-01-13T16:31:09
Updated: 2020-01-22T10:06:09
Reserved: 2020-01-13T00:00:00
Link: CVE-2020-6859
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-01-13T17:15:11.743
Modified: 2020-01-22T13:44:19.757
Link: CVE-2020-6859
JSON object: View
Redhat Information
No data.
CWE