CVE-2018-3783

A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.

Score

CVSS 3.0 9.8 Critical

Status

Modified - support@hackerone.com

Published

2018-08-17

Last modified

2024-08-05

Weaknesses

CWE-89

Affected products

• Flintcms (Flintcms)
• Flintcms (Httpsgithub.comjasonetco)

References

• https://hackerone.com/reports/386807