CVE-2014-1946

OpenDocMan 1.2.7 and earlier does not properly validate allowed actions, which allows remote authenticated users to bypass an intended access restrictions and assign administrative privileges to themselves via a crafted request to signup.php.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2018-04-10

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Opendocman (Opendocman)

References

• http://www.securityfocus.com/archive/1/531351/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91577
• https://www.htbridge.com/advisory/HTB23202