Executive brief
flintcms is a Node.js-based content management system. Versions before 1.1.10 contain a blind NoSQL injection flaw in the password reset mechanism that allows unauthenticated attackers to take over user accounts without proper authorization, bypassing access controls.
Technical details
The vulnerability is a blind NoSQL injection (CWE-89) in flintcms password reset functionality targeting MongoDB. An unauthenticated attacker can inject malicious MongoDB query operators into password reset parameters to manipulate the authentication logic and gain control of arbitrary user accounts. The attack requires only network access and no user interaction. No authentication is required to exploit this flaw. Patched in version 1.1.10 and later.
Affected products
- flintcms flintcms before 1.1.10
Timeline
- 2018-08-21: disclosed
- 2018-08-21: patched: Fixed in version 1.1.10