MediumVulnerability
CVE-2018-20301: Steve Pallen Coherence mass assignment in registration endpoints
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2018-20301
- Published
- Record updated
- Affected
- coherence < 0.5.2
- Fixed in
- 0.5.2
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.9%
Summary
CVE-2018-20301 affects Steve Pallen Coherence before 0.5.2, a flaw similar to a Mass Assignment vulnerability. Its registration endpoints, such as those for creating, editing and updating, let users modify any coherence_fields data, for example by sending confirmed_at with a registration request to confirm their own account. The weakness is classified as CWE-20 (Improper Input Validation), and NIST has not yet provided an assessment.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.