CVE-2021-26600: Type Confusion in ImpressCMS
Summary
CVE-2021-26600: Type Confusion in ImpressCMS. Affects impresscms/impresscms versions < 1.4.3. Fixed in 1.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ImpressCMS is an open-source content management system (CMS) that allows users to create and manage websites. It provides various features such as user management, content publishing, and plugin support. The vulnerability identified as CVE-2021-26600 affects ImpressCMS versions prior to 1.4.3. This vulnerability specifically resides in the autologin.php plugin, which suffers from a type confusion issue due to the use of the '!=' operator instead of the '!==' operator. This type confusion can lead to an authentication bypass, enabling unauthorized access to the system.
Vulnerability Detail
The type confusion vulnerability in ImpressCMS allows an attacker to bypass the authentication mechanism by exploiting the incorrect usage of the '!=' operator. By manipulating the affected code, an attacker can trick the system into considering an invalid authentication token as valid, granting unauthorized access. This can lead to various security risks, including unauthorized data access, privilege escalation, and potential compromise of the entire system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.4.3
This is the first release that contains the fix.
composer require impresscms/impresscms:1.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the autologin.php plugin in ImpressCMS. This can be done by accessing the plugin management section and deactivating the autologin.php plugin. Disabling the plugin will prevent the vulnerable code from being executed, reducing the risk of an authentication bypass. However, it is strongly recommended to apply the official fix by upgrading to ImpressCMS version 1.4.3 or later.
Conclusion
In conclusion, CVE-2021-26600 is a critical vulnerability in ImpressCMS versions prior to 1.4.3. It allows an attacker to bypass the authentication mechanism and gain unauthorized access to the system. Users are advised to upgrade to ImpressCMS version 1.4.3 or later to fix this vulnerability. Alternatively, they can temporarily disable the autologin.php plugin until the upgrade is performed. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for impresscms/impresscms →
FAQ
ImpressCMS is an open-source content management system (CMS) that allows users to create and manage websites. It provides various features such as user management, content publishing, and plugin support.
The vulnerability allows an attacker to bypass the authentication mechanism in ImpressCMS, potentially granting unauthorized access to the system. This can lead to unauthorized data access, privilege escalation, and compromise of the entire system.
To fix this vulnerability, it is recommended to upgrade ImpressCMS to version 1.4.3 or later. This will include the necessary fix for the type confusion issue in the autologin.php plugin.
Yes, a temporary workaround is to disable the autologin.php plugin in ImpressCMS. This can be done through the plugin management section of the CMS.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
Related vulnerabilities
Recent vulnerabilities recorded for impresscms/impresscms.
