Description
A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.
Remediation
References
https://hackerone.com/reports/386807
Related Vulnerabilities
CVE-2018-19586 Vulnerability in maven package org.silverpeas.core:silverpeas-core-web
CVE-2022-24441 Vulnerability in npm package snyk
CVE-2020-14061 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2022-21704 Vulnerability in npm package log4js
CVE-2021-21428 Vulnerability in maven package org.openapitools:openapi-generator-online