CVE-2012-5454 user/index_inline_editor_submit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE:....
MediumCVSS 6.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
user/index_inline_editor_submit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atutor acontent | = 1.2-1 | No fix listed |
References
- 86428 vdb-entry
- 51034 third-party-advisory vendor-advisory
- 56237 vdb-entry
- www.htbridge.com exploit