Description. Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining ...
from Google Alert - vulnerability http://ift.tt/2A7V6sz
via IFTTT
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment