medium6.5
CVE-2017-9378
BigTree CMS through 4.2.18 does not prevent a user from deleting their own account.
Impact
BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks (such as data backups) to complete before a user is deleted.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bigtreecms | Bigtree Cms | through 4.2.18 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/bigtreecms/BigTree-CMS/commit/f7899701d7be91b7dc546b65e44a27b668eb3b76
- https://github.com/bigtreecms/BigTree-CMS/issues/282
- https://github.com/bigtreecms/BigTree-CMS/commit/f7899701d7be91b7dc546b65e44a27b668eb3b76
- https://github.com/bigtreecms/BigTree-CMS/issues/282