CVE-2017-16935 Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/se...
CriticalCVSS 9.8
EPSS 7.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account details via a users/search.json request, and then modifying the account via an editUser request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ametys | < 4.0.3 | 4.0.3 |
References
- blogs.securiteam.com exploit technical-description third-party-advisory
- issues.ametys.org issue-tracking vendor-advisory