QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2020-35935

Back to search

CVE-2020-35935

Published: Jan 1, 2021

Modified: Aug 4, 2024

PUBLISHED

CVSS v3.1

7.5

HIGH

Description

The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)

VendorProductVersions

n/a

n/a

affected
n/a

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N

Attack Complexity

High

Attack Vector

Network

Availability

High

Confidentiality

High

Integrity

High

Privileges Required

Low

Scope

Unchanged

User Interaction

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now