p PatchFirst

CVE-2021-40616

CVE-2021-40616

This page contains facts from public vulnerability sources. Check the original advisory before updating.

thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use condition is that the background user management group authority is required.

CVSS 6.5 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • thinkcmf/thinkcmf Packagist

    Versions
    • 5.0-Beta
    • 5.0-RC4
    • 5.0.170607
    • 5.0.170927
    • 5.0.170927-rc
    • 5.0.180103-beta
    • 5.0.180115-RC
    • 5.0.180123
    • 5.0.180501
    • 5.0.180508
    • 5.0.180525
    • 5.0.180626
    • 5.0.180901
    • 5.0.181212
    • 5.0.181231
    • 5.0.181231-beta
    • 5.0.190111
    • 5.0.190312
    • 5.0.190419
    • 5.0RC1
    • 5.0RC2
    • 5.0RC3
    • 5.1.0-beta
    • v5.1.0
    • v5.1.1
    • v5.1.2
    • v5.1.3
    • v5.1.4
    • v5.1.5
    • v5.1.7
    Affected ranges
    • ECOSYSTEM: < 6.0.0

    Update to 6.0.0

Original sources

Check your server →