CVE-2021-26598 Incorrect Access Control in ImpressCMS
Unauthenticated attackers can access user search functionality in ImpressCMS due to incorrect access control, potentially exposing user data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-26598?
CVE-2021-26598 is a medium-severity missing authorization vulnerability in n/a, published on 28 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).
Weakness: CWE-287
Which versions are affected by CVE-2021-26598?
2 open source packages ship an affected version, including impresscms/impresscms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
impresscms/impresscms Packagist | All versions | 1.4.3 |
impresscms/impresscms Packagist | All versions | 1.4.3 |
Products include Impresscms Impresscms.
How do I fix CVE-2021-26598?
Upgrade impresscms/impresscms to 1.4.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-26598 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-26598 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2008-3453 Multiple unspecified vulnerabilities in ImpressCMS 1.0 have unknown impact and attack vectors, related to modules/admin.php and "a few files
- CVE-2021-26599 SQL Injection in ImpressCMS
- CVE-2021-26600 Type Confusion in ImpressCMS
- CVE-2022-24977 Path Traversal in ImpressCMS
- CVE-2022-50912 ImpressCMS 1.4.4 - Unrestricted File Upload
Sources
Also known as GHSA-48p3-xfvw-g59c.