CVE-2017-16935 | BDVDB-2026-93395 Detail

Description#

Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account details via a users/search.json request, and then modifying the account via an editUser request.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://blogs.securiteam.com/index.php/archives/3517
https://issues.ametys.org/browse/RUNTIME-2582

Exploit#

No public exploit known

History#

Version 12017-11-24Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.