PT-2017-17742

CVE-2017-7446

Published

2017-04-05

Updated

2017-08-16

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HelpDEZk version 1.1.1

Description The issue allows for obtaining admin privileges through CSRF in the "admin/home#/person/" endpoint.

Recommendations For HelpDEZk version 1.1.1, update to a version that includes a fix for this issue, as using the admin/home#/person/ endpoint can lead to admin privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors

Affected products

Weakness enumeration