Skip to main content

Classcms CVE-2024-12666

MEDIUM
Incorrect Privilege Assignment (CWE-266)
2024-12-16 cna@vuldb.com
Information Disclosure Classcms
5.1
CVSS 4.0 · Vendor: vuldb
Share

Severity by source

Vendor (vuldb) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

1
CVE Published
Dec 16, 2024 - 20:15 cve.org
MEDIUM 5.1

DescriptionCVE.org

A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper handling of insufficient privileges. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-266. A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper handling of insufficient privileges. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Affected products include: Classcms. Version information: up to 4.8.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Classcms

View all
CVE-2022-45966 CRITICAL POC
9.8 Dec 22

here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5. Rated critical sev
CVE-2022-25581 HIGH POC
7.8 Mar 18

Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. Rated high severity (CVS
CVE-2024-48180 CRITICAL
9.8 Oct 16

ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uplo
CVE-2022-25582 MEDIUM POC
5.4 Mar 25

A stored cross-site scripting (XSS) vulnerability in the Column module of ClassCMS v2.5 and below allows attackers to ex
CVE-2024-8144 MEDIUM POC
5.3 Aug 25

A vulnerability classified as problematic was found in ClassCMS 4.8. Rated medium severity (CVSS 5.3), this vulnerabilit
CVE-2024-6932 MEDIUM POC
5.3 Jul 20

A vulnerability was found in ClassCMS 4.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
CVE-2024-12503 MEDIUM POC
5.1 Dec 12

A vulnerability classified as problematic was found in ClassCMS 4.8. Rated medium severity (CVSS 5.1), this vulnerabilit
CVE-2024-8145 MEDIUM POC
5.1 Aug 25

A vulnerability, which was classified as problematic, has been found in ClassCMS 4.8. Rated medium severity (CVSS 5.1),

CVE-2024-57099 CRITICAL POC
9.8 Feb 03

ClassCMS v4.8 has a code execution vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-57097 MEDIUM POC
4.8 Feb 03

ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php. Rated medium severity (CVSS 4.8), t

Same weakness CWE-266 – Incorrect Privilege Assignment

View all
CVE-2025-27007 CRITICAL POC
9.8
CVE-2024-28000 CRITICAL POC
9.8
CVE-2026-48172 CRITICAL POC
10.0
CVE-2024-24882 CRITICAL POC
9.8
CVE-2025-47539 CRITICAL POC
9.8
CVE-2024-54363 CRITICAL
9.8
CVE-2026-23550 CRITICAL POC
9.8
CVE-2024-50485 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-12666 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy