CVE-2017-11681

High

Published: 27/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2017-11681 vulnerability in Hashtopussy 0.4.0 concerns incorrect access control, allowing remote authenticated users to perform actions reserved for administrative roles, as demonstrated by an action=createVoucher request to agents.php.

Risk Assessment

The risk to the organization is that remote users may gain access to administrative functions, potentially leading to unauthorized actions and security breaches.

Recommendation

It is recommended to update Hashtopussy to the latest version to fix this vulnerability and to review and strengthen access controls in the application.

Other vulnerabilities in Hashtopussy 0.4.0

CVE-2017-11680High
Hashtopussy 0.4.0 has a Cross-Site Request Forgery (CSRF) vulnerability that allows an admin password change via users.php.

Original NVD description (English source)

Incorrect Access Control vulnerability in Hashtopussy 0.4.0 allows remote authenticated users to execute actions that should only be available for administrative roles, as demonstrated by an action=createVoucher request to agents.php.