| Package | Affected versions | Patched versions |
|---|---|---|
| navigate cms | = 2.9 |
An issue was discovered in Navigate CMS 2.9 r1433. When performing a password reset, a user is emailed an activation code that allows them to reset their password. There is, however, a flaw when no activation code is supplied. The system will allow an unauthorized user to continue setting a password, even though no activation code was supplied, setting the password for the most recently created user in the system (the user with the highest user id).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free