High severity · published Dec 16, 2024
CVE-2024-12666
ClassCMS User Management Page admin insufficient privileges
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper handling of insufficient privileges. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
ClassCMS ·
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12666
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12666
Exploit
https://github.com/Jack-Black-13/blob/blob/main/ClassCMS%20V4.8%20Vertical%20Privilege%20Escalation.md
Permissions Required
https://vuldb.com/?ctiid.288535
Third Party Advisory
https://vuldb.com/?id.288535
Third Party Advisory
https://vuldb.com/?submit.461120
More from ClassCMS
6.1
CVE-2024-8144
ClassCMS Logo admin cross site scripting
5.4
CVE-2024-6932
ClassCMS cross site scripting
4.8
CVE-2024-12503
ClassCMS Model Management Page admin cross site scripting
4.8
CVE-2024-8145
ClassCMS Article admin cross site scripting