CVE-2007-6547 RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent attackers to change passwords upon obtaining temporary access to a session.
MediumCVSS 6.8
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent attackers to change passwords upon obtaining temporary access to a session.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| runcms | <= 1.6 | No fix listed |
References
- 41246 vdb-entry
- 3493 third-party-advisory
- www.runcms.org
- 20071225 Multiple vulnerabilities in RUNCMS 1.6 by DSecRG mailing-list
- 27019 patch vdb-entry
- 4790 exploit