CVE-2020-26167

moderate-risk
Published 2020-11-04

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.

Do I need to act?

~
3.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Thedaylightstudio

References (9)

https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-26167
Third Party Advisory https://excellium-services.com/cert-xlm-advisory/cve-2020-26167/
Third Party Advisory https://github.com/daylightstudio/FUEL-CMS/
Vendor Advisory https://thedaylightstudio.com/
Product https://www.getfuelcms.com/
Third Party Advisory https://excellium-services.com/cert-xlm-advisory/cve-2020-26167/
Third Party Advisory https://github.com/daylightstudio/FUEL-CMS/
Vendor Advisory https://thedaylightstudio.com/
Product https://www.getfuelcms.com/
43
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 6/34 · Minimal
Exposure 5/34 · Minimal