Vulnerability in Cmsmadesimple Cms Made Simple

CVE-2007-5441

CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an "admin/adminlog.php?page=1" request.

EPSS: 0.011 (62.5th percentile) — read the EPSS interpretation.

Affected products

Cmsmadesimple Cms_made_simple — versions 1.1.3.1
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (x_refsource_OSVDB, vdb-entry)
cve@mitre.org (x_refsource_CONFIRM)
cve@mitre.org (x_refsource_SREASON, third-party-advisory)