An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack of a requirement to provide the old password, and the lack of security tokens.
References
Link | Resource |
---|---|
https://pastebin.com/ZPECbgZb | Exploit Third Party Advisory |
https://phpipam.net/news/phpipam-v1-5-released/ | Broken Link Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-03-04T16:07:52
Updated: 2020-03-04T16:07:52
Reserved: 2020-01-26T00:00:00
Link: CVE-2020-7988
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-03-04T17:15:11.830
Modified: 2020-03-05T21:25:34.827
Link: CVE-2020-7988
JSON object: View
Redhat Information
No data.
CWE