CVE-2018-1000133

ALTO 7.5CVE-2018-1000133 · Published 16/03/2018 · updated 17/06/2026

In breve

CVE-2018-1000133 è una vulnerabilità ALTO (CVSS 7.5) che riguarda trident (secluded).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 70.7% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
trident secluded	`= 1.4.6`	No fix yet

Description

Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork components that can result in A standard unprivileged user could gain system administrator permissions within the web portal.. This attack appear to be exploitable via The user must be able to login, and could edit their profile and set the "System Administrator" permission to "yes" on themselves.. This vulnerability appears to have been fixed in 1.4.6 RC2.

References

tridentli/pitchfork commit 33549f1 · Patch
tridentli/pitchfork commit 9fd07cb · Patch
tridentli/pitchfork · Issue Tracking
tridentli/trident release DEV_1.4.6-RC2 · Third Party Advisory
thomas-ward.net/security-advisories/trident-trusted-communications-platform-privilege-escalation-issue-advisory · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free