CVE-2018-10519: High severity simple cms vulnerability

Published Apr 27, 2018

Updated

CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the effuid value within $COOKIE[$this->loginkey] to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because of an incorrect fix for CVE-2018-10084.

Affected Software

1 affected component

CMSmadesimple CMS Made Simple=2.2.7

Event History

Apr 27, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-10519?

CVE-2018-10519 has a high severity rating due to its potential for privilege escalation.

How do I fix CVE-2018-10519?

To fix CVE-2018-10519, upgrade CMS Made Simple to version 2.2.8 or later where the vulnerability is patched.

What type of vulnerability is CVE-2018-10519?

CVE-2018-10519 is a privilege escalation vulnerability allowing ordinary users to gain admin access.

Which versions of CMS Made Simple are affected by CVE-2018-10519?

CVE-2018-10519 affects CMS Made Simple version 2.2.7 specifically.

Can CVE-2018-10519 be exploited remotely?

Yes, CVE-2018-10519 can be exploited remotely due to its reliance on accessible files in the tmp/ directory.