How severe is CVE-2019-10270?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.8 out of 10.

What type of vulnerability is CVE-2019-10270?

This is classified as CWE-640, which is a common weakness in software security.

CVE-2019-10270 - HIGH Severity | CVSS 8.8

Vulnerability Description

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation.

Related Vulnerabilities

CVE-2017-12850

HIGH

CVSS:8.8(High)

An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.

CWE-6402017

CVE-2017-12851

HIGH

CVSS:8.8(High)

An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.

CWE-6402017

CVE-2017-7615

HIGH

CVSS:8.8(High)

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

CWE-6402017

CVE-2018-0787

HIGH

CVSS:8.8(High)

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege...

CWE-6402018

CVE-2018-11134

HIGH

CVSS:8.8(High)

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set o...

CWE-6402018

CVE-2018-17401

HIGH

CVSS:8.8(High)

The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by exploiting its Forgot Password feature. NOTE: the ven...

CWE-6402018