CVE-2017-14231: GeniXCMS Denial of Service (Account Blockage)
Summary
CVE-2017-14231: GeniXCMS denial of service (account blockage). Affects genix/cms versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeniXCMS is a content management system that allows users to create and manage websites. It provides features such as user registration, account management, and content publishing. The vulnerability identified as CVE-2017-14231 affects GeniXCMS versions prior to 1.1.0. This vulnerability can be exploited remotely, leading to a denial of service by blocking user accounts. The issue arises from the mishandling of certain username substring relationships in the register.php, User.class.php, and Type.class.php files.
Vulnerability Detail
The vulnerability in GeniXCMS allows an attacker to cause a denial of service by leveraging the mishandling of username substring relationships. By using a specific username substring, such as 'admin<script>', the attacker can trigger the account blockage mechanism. This can result in the targeted user's account being blocked, preventing them from accessing their account and performing any actions within the CMS. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.1.0
This is the first release that contains the fix.
composer require genix/cms:1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is advised to apply the recommended fix by upgrading to GeniXCMS version 1.1.0 or later.
Conclusion
The vulnerability in GeniXCMS prior to version 1.1.0 allows remote attackers to cause a denial of service by exploiting the mishandling of certain username substring relationships. To mitigate this issue, users should upgrade their GeniXCMS installation to version 1.1.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for genix/cms →
FAQ
GeniXCMS is a content management system that allows users to create and manage websites. It provides features such as user registration, account management, and content publishing.
The vulnerability allows an attacker to cause a denial of service by blocking user accounts. This can prevent affected users from accessing their accounts and performing any actions within the CMS.
To fix this vulnerability, it is recommended to upgrade GeniXCMS to version 1.1.0 or later. This version includes a fix for the mishandling of username substring relationships.
There is no specific workaround available for this vulnerability. It is advised to apply the recommended fix by upgrading to GeniXCMS version 1.1.0 or later.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for genix/cms.
