vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2018-1000133

N/A
Published: March 16, 2018 at 02:04 PM UTC
Updated: June 17, 2026 at 01:32 AM UTC
1 product affected across 1 vendorTrident

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 1%

Description

Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork components that can result in A standard unprivileged user could gain system administrator permissions within the web portal.. This attack appear to be exploitable via The user must be able to login, and could edit their profile and set the "System Administrator" permission to "yes" on themselves.. This vulnerability appears to have been fixed in 1.4.6 RC2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (5)

x_refsource_CONFIRMPatchThird Party Advisory
Source: [email protected]
https://github.com/tridentli/pitchfork/commit/33549f15707801099e1253dd5e79369bd48eb59b
x_refsource_CONFIRMPatchThird Party Advisory
Source: [email protected]
https://github.com/tridentli/pitchfork/commit/9fd07cbe4f93e1367e142016e9a205366680dd54
x_refsource_CONFIRMIssue TrackingThird Party Advisory
Source: [email protected]
https://github.com/tridentli/pitchfork/issues/168
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://github.com/tridentli/trident/releases/tag/DEV_1.4.6-RC2
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://thomas-ward.net/security-advisories/trident-trusted-communications-platform-privilege-escalation-issue-advisory/

CVSS

6MEDIUM[email protected]
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-269

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card