CVE-2020-8439

2020-03-0701:15:15

Google

osv.dev

6.7 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

55.7%

JSON

Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI.

CPENameOperatorVersion
monstraeq3.0.2
monstraeq2.2.0
monstraeq3.0.1
monstraeq2.3.0
monstraeq3.0.4
monstraeq3.0.3
monstraeq2.2.1
monstraeq2.3.1
monstraeq3.0.0