CWE Code: 639
Vulnerability Type: privilege_escalation
CVSS Score: 4.0
CWE Name:  Authorization Bypass Through User-Controlled Key
Summary: in monstra cms 3.0.4, an attacker with 'editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&user_id=1, insecure direct object reference (idor).
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2018-09-10
Last Modified Date: 2019-10-03