Description
A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SiteServer | SSCMS | 7.0, 7.1, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.2, 7.2.0, 7.2.1, 7.3, 7.4.0 | — |
References
- VDB-432921 | SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication vdb-entry technical-description
- VDB-432921 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-124575 | CVE Analysis and Report third-party-advisory
- Submit #1038068 | siteserver SiteServer CMS (SSCMS) 7.4.0 Improper Restriction of Excessive Authentication Attempts third-party-advisory
- https://github.com/siteserver/cms/blob/15144f30c6cc0e11d50985b6ab9236cfce8cacbd/src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs#L46 related
- https://github.com/siteserver/cms/pull/3905 issue-tracking patch
- https://github.com/siteserver/cms/commit/df3becb7ebb00a48435418a44fd08a459eb38ace patch