Description
UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitrary cookie values that are set and not empty.
Unscored
CVE-2018-19437
EUVD-2018-11128GHSA-298v-7gc3-86vj
UCMS 1.4.7 allows remote authenticated users to change the administrator password because $_COOKIE['admin_'.cookiehash] is used for arbitra…
Published Nov 22, 2018 · Updated Aug 5, 2024 · Assigned by mitre