zoujingli/thinkadmin · Security
ThinkAdmin Administrator cookies still working after password change
- GHSA ID
- GHSA-qv5j-rwq3-m823
- CVE ID
- CVE-2019-11018
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.
CWEs
- CWE-287 · Improper Authentication