CVE-2020-35935

The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)
Configurations

Configuration 1 (hide)

cpe:2.3:a:vasyltech:advanced_access_manager:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 05:28

Type Values Removed Values Added
CVSS v2 : 6.0
v3 : 8.8
v2 : 6.0
v3 : 7.5
References () https://www.wordfence.com/blog/2020/08/high-severity-vulnerability-patched-in-advanced-access-manager/ - Exploit, Third Party Advisory () https://www.wordfence.com/blog/2020/08/high-severity-vulnerability-patched-in-advanced-access-manager/ - Exploit, Third Party Advisory

05 Jan 2024, 14:36

Type Values Removed Values Added
CWE CWE-269 NVD-CWE-noinfo
CPE cpe:2.3:a:advanced_access_manager_project:advanced_access_manager:*:*:*:*:*:wordpress:*:* cpe:2.3:a:vasyltech:advanced_access_manager:*:*:*:*:*:wordpress:*:*

Information

Published : 2021-01-01 02:15

Updated : 2024-11-21 05:28


NVD link : CVE-2020-35935

Mitre link : CVE-2020-35935

CVE.ORG link : CVE-2020-35935


JSON object : View

Products Affected

vasyltech

  • advanced_access_manager