What is GHSA-hh92-wg7v-8vfr?

GHSA-hh92-wg7v-8vfr is a security advisory published by GitHub Security Advisories with Medium severity. Gleez CMS Vulnerability Allows Forced Browsing to Profile Page of Other Users

Which CVE IDs does GHSA-hh92-wg7v-8vfr cover?

GHSA-hh92-wg7v-8vfr covers the following CVE IDs: CVE-2018-16704. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hh92-wg7v-8vfr?

GHSA-hh92-wg7v-8vfr has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-hh92-wg7v-8vfr?

GHSA-hh92-wg7v-8vfr affects 1 product, including: composer/gleez/cms:\u003c= 1.2.0.

GHSA-hh92-wg7v-8vfrMediumCVSS 4.3

Gleez CMS Vulnerability Allows Forced Browsing to Profile Page of Other Users

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

April 25, 2024

🔗 CVE IDs covered (1)

CVE-2018-16704 →

📋 Description

An issue was discovered in Gleez CMS v1.2.0. Because of an Insecure Direct Object Reference vulnerability, it is possible for attackers (logged in users) to view profile page of other users, as demonstrated by navigating to user/3 on demo.gleezcms.org.

🎯 Affected products1

composer/gleez/cms:<= 1.2.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2018-16704
https://github.com/gleez/cms/issues/801
https://github.com/advisories/GHSA-hh92-wg7v-8vfr