CVE-2018-16608 - CVE House
Back to Database
Status published High CVE-2018-16608

In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can...

Vulnerability Description

In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&user_id=1, Insecure Direct Object Reference (IDOR).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-16608

Credits & Attribution

No credits recorded in the NVD database.

References

More from monstra

View All →
CVE-2021-40940
Monstra 3.0.4 does not filter the case of php, which...
Critical 9.8
CVE-2021-36548
A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog...
Critical 9.8
CVE-2020-8439
Monstra CMS through 3.0.4 allows remote authenticated users to take...
Medium 6.5
CVE-2020-25414
A local file inclusion vulnerability was discovered in the captcha...
Critical 9.8
CVE-2020-23697
Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the...
Medium 5.4

Affected Vendor

Affected Software

monstra
Vulnerable Versions:
3.0.4

Timeline

Official Publish: September 10th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.