CVE-2020-18741

2021-07-0816:29:11

mitre

www.cve.org

5.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.6%

JSON

Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user’s photo via the “photoid%5B%5D” and “photodesc%5B%5D” parameters in the component “index.php?app=photo.”

References

github.com/thinksaas/ThinkSAAS/issues/19