CVE-2020-36969

M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions by manipulating the admin parameter. Attackers can send a POST request to the /api/1/admin/users/update endpoint with a crafted payload to grant administrative access to a standa...

CVE-2020-36969

CVE-2020-36969 affects M/Monit 3.7.4. A privilege-escalation flaw allows an authenticated user to modify permissions by tampering with the admin parameter via POST to /api/1/admin/users/update, potentially granting admin rights to a standard user. Public references (e.g., Exploit-DB) indicate a P...

CVE-2020-36969

M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions by manipulating the admin parameter. Attackers can send a POST request to the /api/1/admin/users/update endpoint with a crafted payload to grant administrative access to a standa...

CVE-2020-36969 M/Monit 3.7.4 - Privilege Escalation

M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions by manipulating the admin parameter. Attackers can send a POST request to the /api/1/admin/users/update endpoint with a crafted payload to grant administrative access to a standa...

CVE-2020-36969: Incorrect Authorization

M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions by manipulating the admin parameter. Attackers can send a POST request to the /api/1/admin/users/update endpoint with a crafted payload to grant administrative access to a standa...

CVE-2019-11393

An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter...

PT-2019-12279

Name of the Vulnerable Software and Affected Versions M/Monit versions prior to 3.7.3 Description An issue was discovered in the "/admin/users/update" API endpoint. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the adm...

CVE-2014-6409: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords via the fullname and password parameters to /admin/users/update...

PT-2014-7212

Name of the Vulnerable Software and Affected Versions M/Monit versions 3.3.2 and earlier Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that change user passwords. This is achieved via the fullname and password parameters...