CVE-2019-11018: Critical severity thinkadmin vulnerability

Published Apr 8, 2019

Updated

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.

Other sources

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.

Affected Software

3 affected components

composer/zoujingli/thinkadmin=4.0

ThinkAdmin ThinkAdmin=4.0

Ctolog Thinkadmin=4.0

Event History

Apr 8, 2019

CVE Published

via MITRE·08:37 PM

Data Sourced

via MITRE·08:37 PM

Description

May 13, 2022

Advisory Published

via GitHub·01:21 AM

Frequently Asked Questions

What is CVE-2019-11018?

CVE-2019-11018 is a vulnerability in ThinkAdmin V4.0 that allows continued use of an administrator's cookie-based credentials after a password change.

How does CVE-2019-11018 affect ThinkAdmin V4.0?

CVE-2019-11018 allows an attacker to maintain access to an administrator account even after the password has been changed.

What is the severity of CVE-2019-11018?

CVE-2019-11018 has a severity rating of 9.8 (out of 10), indicating a critical vulnerability.

How can I fix CVE-2019-11018 in ThinkAdmin V4.0?

To fix CVE-2019-11018, it is recommended to update to a version of ThinkAdmin that includes a patch for the vulnerability.

Where can I find more information about CVE-2019-11018?

More information about CVE-2019-11018 can be found at the following link: [GitHub Issue #173](https://github.com/zoujingli/ThinkAdmin/issues/173)