PT-2020-20670

CVE-2020-9456

Published

2020-03-06

Updated

2022-01-21

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RegistrationMagic plugin versions prior to 4.6.0.4

Description The issue allows remote authenticated users with minimal privileges to elevate their privileges to administrator. This is achieved through the user controller in the class rm user controller.php file, specifically the rm user edit function.

Recommendations For versions prior to 4.6.0.4, update to version 4.6.0.4 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Ramuel Gall

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers