CVE-2021-25991mediumCWE-284

CVE-2021-25991: medium-severity vulnerability in ifmeorg ifme

ifme - Improper Access Control leads to admin deactivation

Published · Updated

Follow this CVE+ Monitor ifme

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.7epss 0.8%
In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected products
ifmeorg · ifme
Related CVEs — ifmeorg ifme

In the same product, most dangerous first.

CVE-2021-25992CRITICALifme - Insufficient Session ExpirationEPSS 1.6%CVE-2021-25990MEDIUMifme - Stored Cross-Site Scripting (XSS) in Contacts sectionEPSS 0.6%CVE-2021-25989MEDIUMifme - Stored Cross-Site Scripting (XSS) in Groups sectionEPSS 0.6%CVE-2021-25988MEDIUMifme - Stored Cross-Site Scripting (XSS) in Notifications sectionEPSS 0.6%