CVE-2007-5441
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
6.3 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
65.0%
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an “admin/adminlog.php?page=1” request.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| cmsmadesimple:cms_made_simple | cmsmadesimple cms made simple | eq | 1.1.3.1 |
Related
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
6.3 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
65.0%