CVE-2021-40101

High

An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current…

mitre·CWE-732·Published 2021-11-30

CVSS

7.2

EPSS

0.03

KEV

Exploits

cve.orgen

149 chars

An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password.

NVDen

149 chars

An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a prompt for the current password.

Se ha detectado un problema en Concrete CMS versiones anteriores a 8.5.7. El Dashboard permite cambiar la contraseña de un usuario sin que le sea pedida la contraseña actual

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	6.5	8.0	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P
3.1	Primary	NVD	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H