CVE-2019-10270

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation.

CVSS v3 8.8 HIGH
CVSS v2.0 4.0 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://cxsecurity.com/issue/WLB-2019060101	Exploit Third Party Advisory
https://cxsecurity.com/issue/WLB-2019060101	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 04:18

Type	Values Removed	Values Added
References	~~() https://cxsecurity.com/issue/WLB-2019060101 - Exploit, Third Party Advisory~~	() https://cxsecurity.com/issue/WLB-2019060101 - Exploit, Third Party Advisory

Information

Published : 2019-06-21 18:15

Updated : 2024-11-21 04:18

NVD link : CVE-2019-10270

Mitre link : CVE-2019-10270

CVE.ORG link : CVE-2019-10270

JSON object : View

Products Affected

ultimatemember

ultimate_member

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2019-10270", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-06-21T18:15:09.577", "references": [{"url": "https://cxsecurity.com/issue/WLB-2019060101", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://cxsecurity.com/issue/WLB-2019060101", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation."}, {"lang": "es", "value": "Se detect\u00f3 un problema de restablecimiento de contrase\u00f1a arbitrario en el plugin Member versi\u00f3n 2.39 de Ultimate para WordPress. Es posible restablecer la contrase\u00f1a de otro usuario (debido a la falta de comprobaci\u00f3n y correlaci\u00f3n entre la clave de restablecimiento de la contrase\u00f1a enviada por correo y el par\u00e1metro user_id). Solo se necesita conocer el user_id, que est\u00e1 disponible p\u00fablicamente. Solo hay que interceptar la solicitud de modificaci\u00f3n de contrase\u00f1a y modificar el ID de usuario. Es posible modificar las contrase\u00f1as de cualquier usuario o administrador de WordPress Ultimate Members. Esto podr\u00eda conllevar a comprometer la cuenta y la escalada de privilegios."}], "lastModified": "2024-11-21T04:18:47.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "A0451A41-7BA3-42DA-A431-52551BC7C4EE", "versionEndExcluding": "2.0.40"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}