Read the docs

ifmeorg

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

ifmeorg records in CISA KEV

No ifmeorg vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ifme 5 records HIGH

Records

5 records

TI-2021-07997 CVE-2021-25991 · GHSA-9869-mhm7-vvmm

ifme - Improper Access Control leads to admin deactivation

Priority HIGH 65

In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access…

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00829 Published 2021-12-29 No fix listed CWE-284
TI-2021-07996 CVE-2021-25990 · GHSA-f8jj-6823-vfgv

ifme - Stored Cross-Site Scripting (XSS) in Contacts section

Priority MEDIUM 58

In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00636 Published 2021-12-29 No fix listed CWE-79
TI-2021-07995 CVE-2021-25989 · GHSA-5pg4-q67x-c7x9

ifme - Stored Cross-Site Scripting (XSS) in Groups section

Priority MEDIUM 58

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00636 Published 2021-12-29 No fix listed CWE-79
TI-2021-07994 CVE-2021-25988 · GHSA-fwv7-9j7c-rjhr

ifme - Stored Cross-Site Scripting (XSS) in Notifications section

Priority MEDIUM 58

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00636 Published 2021-12-29 No fix listed CWE-79
TI-2021-07998 CVE-2021-25992 · GHSA-xmp3-76fc-6jhm

ifme - Insufficient Session Expiration

Priority MEDIUM 45

In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01603 Published 2022-02-10 No fix listed CWE-613
Open these records in search →