CVE-2020-26167

2020-11-0417:15:13

Google

osv.dev

fuel cms

page preview

ownership takeover

administrator account

AI Score

6.8

Confidence

Low

EPSS

0.005

Percentile

76.8%

JSON

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.

References

excellium-services.com/cert-xlm-advisory/cve-2020-26167/

github.com/daylightstudio/FUEL-CMS/

thedaylightstudio.com/

www.getfuelcms.com/