CVE-2017-16935
CriticalSummary
Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, allowing remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml.
Risk Assessment
Attackers can gain access to user accounts and change admin passwords, leading to serious security breaches within the organization.
Recommendation
It is recommended to update Ametys to version 4.0.3 or later to mitigate this vulnerability and implement additional security measures.
Original NVD description (English source)
Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account details via a users/search.json request, and then modifying the account via an editUser request.