Description (CNA)
Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Azuriom / Azuriom CMS | affected 0 through 1.2.11 |
CWE
CWE-862, CWE-269
References
- https://github.com/Azuriom/Azuriom/releases/tag/v1.2.11
- https://github.com/Azuriom/Azuriom/commit/4b744bc0dd11f205f5aa053c6db8a949d3f0608e
- https://github.com/Azuriom/Azuriom
ADP enrichment
No English description supplied.
No references supplied.