Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Instant Update CMS lets attackers take over accounts

CVE-2018-1000501 · published 8 years ago
Summary

The password reset function in Instant Update CMS can be tricked into resetting any user’s password, letting an attacker gain full access to that account. This can be done over the network without needing special privileges. Upgrade to version 0.3.3 or later to close the issue, and ensure any existing passwords are changed immediately.

What to do
  • Update instant-update instant_update_cms to version 0.3.3 or later.
Affected software
VendorProductAffected versions
instant-update instant_update_cms < 0.3.3
cpe:2.3:a:instant-update:instant_update_cms:*:*:*:*:*:*:*:*
Original advisory text
Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploit...
Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in v0.3.3.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-640Weak Password Recovery Mechanism for Forgotten Password
Timeline
Published26 Jun 2018
Updated2 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-1000501 · NVD
Track software like this
Free during beta