CVE-2023-43154

{"id": "CVE-2023-43154", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-09-27T15:19:33.323", "references": [{"url": "https://cxsecurity.com/issue/WLB-2023090075", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/ally-petitt/macs-cms-auth-bypass", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "In Macrob7 Macs Framework Content Management System (CMS) 1.1.4f, loose comparison in \"isValidLogin()\" function during login attempt results in PHP type confusion vulnerability that leads to authentication bypass and takeover of the administrator account."}, {"lang": "es", "value": "En Macrob7 Macs Framework Content Management System (CMS) 1.1.4f, la comparaci\u00f3n vaga en la funci\u00f3n \"isValidLogin()\" durante el intento de inicio de sesi\u00f3n da como resultado una vulnerabilidad de confusi\u00f3n de tipo PHP que conduce a la omisi\u00f3n de autenticaci\u00f3n y la toma de control de la cuenta de administrador."}], "lastModified": "2023-10-02T16:51:34.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:macs_cms_project:macs_cms:1.1.4f:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98B08F9C-C783-4DD6-B23E-5F12488A8DB2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}