CVE-2018-19109

tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/cms/column/list directly to read the column list page or edit a column.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2018-11-08

Last modified

2024-08-05

Weaknesses

CWE-425

Affected products

• Tianti (Tianti Project)

References

• https://github.com/xujeff/tianti/issues/29