vulnwire
7.3high

CVE-2016-15002

MONyog Ultimate Cookie privileges management

Published 4 y ago · modified 4 mo ago · JSON

CVSS
7.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 63%
Public exploits
0
none known

A vulnerability, which was classified as critical, was found in MONyog Ultimate 6.63. This affects an unknown part of the component Cookie Handler. The manipulation of the argument HasServerEdit/IsAdmin leads to privilege escalation. It is possible to initiate the attack remotely.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction (EPSS)

0.99% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.17.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA3.17.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD3.18.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • unspecified MONyog Ultimate

Classification

Weakness
  • CWE-269 Improper Privilege Management
  • CWE-565 Reliance on Cookies without Validation and Integrity Checking

References

  • youtu.be /KKlwi-u6wyA · x_refsource_MISC, x_transferred
  • vuldb.com /?id.98355 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.