critical9.8Public exploit code
CVE-2017-16935
Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions vi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Ametys CMS 4.0.2 - Password Reset2017-11-07 · webapps · php
Impact
Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account details via a users/search.json request, and then modifying the account via an editUser request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ametys | Ametys | before 4.0.3 |