Vulnerability · Published Dec 29, 2021 · Assigned by Mend
CVE-2021-25991ifme - Improper Access Control leads to admin deactivation
Medium 5.7
In plain English
A medium-severity improper access control in ifme from ifmeorg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)0.8%top 42.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H