Description

An issue was discovered in phpList 3.6.12. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one to perform an account takeover of the user with super-admin permission.

Remediation

References

CVE-2023-27576

Related Vulnerabilities

Magento XML Injection (aka Blind XPath Injection) Vulnerability (CVE-2019-8158)

SugarCRM Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3803)

WordPress Plugin WP Statistics Cross-Site Scripting (12.0.8.1)

Magento Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-8151)

Undertow Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2017-7559)

Severity

Medium

Classification

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CVE-2023-27576