medium6.5
CVE-2021-40616
Incorrect Authorization in thinkcmf
Impact
thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use condition is that the background user management group authority is required.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | thinkcmf/thinkcmf | <= 5.1.7 | 6.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Thinkcmf | Thinkcmf | Version 5.1.7 |