Privilege Escalation due to Blind NoSQL Injection in flintcms

심각 9.8CVE-2018-3783 · GHSA-jhq3-57xh-6643 · Published 17/08/2018 · updated 17/06/2026

요약

Package	Affected versions	Patched versions
flintcms flintcms	`≤ 1.1.9`	No fix yet
flintcms npm	`< 1.1.10`	`1.1.10`

Versions of flintcms before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset.

Update to version 1.1.10 or later.

NVD description

A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.