CVE-2017-11422 describes a critical access control vulnerability in the Statamic framework prior to version 2.6.0. This flaw allows authenticated attackers to bypass session permission checks when invoking user class methods, potentially enabling unauthorized actions like password resets, account creation, or role modifications. With a CVSS score of 8.8 (High), this vulnerability is easily exploitable over the network with low complexity, leading to high impacts on confidentiality, integrity, and availability. While no public exploits, Metasploit modules, or KEV entries exist, and community discussion is minimal, the potential for significant unauthorized access warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.6.0CPE matchmatch criteria | cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.