CVE-2018-10305
First published: Tue Apr 24 2018(Updated: )
The MessageSearch2 function in PersonalMessage.php in Simple Machines Forum (SMF) before 2.0.15 does not properly use the possible_users variable in a query, which might allow attackers to bypass intended access restrictions.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Simplemachines Simple Machines Forum | <2.0.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2018-10305?
CVE-2018-10305 is a vulnerability in Simple Machines Forum (SMF) before version 2.0.15 that allows attackers to bypass intended access restrictions.
How severe is CVE-2018-10305?
CVE-2018-10305 has a severity rating of 9.8 (Critical).
What is the affected software for CVE-2018-10305?
The affected software for CVE-2018-10305 is Simple Machines Forum (SMF) before version 2.0.15.
How can an attacker exploit CVE-2018-10305?
An attacker can exploit CVE-2018-10305 by bypassing intended access restrictions in Simple Machines Forum (SMF).
Is there a fix available for CVE-2018-10305?
Yes, the fix for CVE-2018-10305 is to update Simple Machines Forum (SMF) to version 2.0.15 or later.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/simplemachines
- canonical/simplemachines simple machines forum