CVE-2018-16703

A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help an attacker to perform login attempts in excess of the configured login attempt limit. The vulnerability is due to insufficient server-side access control and login attempt limit enforcement. An attacker could exploit this vulnerability by sending modified login attempts to the Portal login page. An exploit could allow the attacker to identify existing users and perform brute-force password attacks on the Portal, as demonstrated by navigating to the user/4 URI.
References
Link Resource
https://github.com/gleez/cms/issues/802 Third Party Advisory
https://github.com/gleez/cms/issues/802 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gleeztech:gleez_cms:1.2.0:*:*:*:*:*:*:*

History

21 Nov 2024, 03:53

Type Values Removed Values Added
References () https://github.com/gleez/cms/issues/802 - Third Party Advisory () https://github.com/gleez/cms/issues/802 - Third Party Advisory

Information

Published : 2018-09-07 17:29

Updated : 2024-11-21 03:53


NVD link : CVE-2018-16703

Mitre link : CVE-2018-16703

CVE.ORG link : CVE-2018-16703


JSON object : View

Products Affected

gleeztech

  • gleez_cms
CWE
CWE-307

Improper Restriction of Excessive Authentication Attempts

CWE-521

Weak Password Requirements

CWE-732

Incorrect Permission Assignment for Critical Resource