Description (CNA)
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| craftcms / cms | affected 5.0.0 before 5.11.0; unaffected 5.11.0 |
CWE
CWE-287
References
- https://github.com/craftcms/cms/security/advisories/GHSA-xh42-494x-2xgv
- https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.0-verification-code-reuse-via-users-set-password
ADP enrichment
No English description supplied.
No references supplied.