{"id":"CVE-2018-20301","aliases":["EUVD-2022-1108","GHSA-mrq8-53r4-3j5m"],"status":"published","title":"Permissive parameters and privilege escalation","description":"An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, \"registration\" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00896,"percentile":0.59791,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-12-20T09:00:00Z","modified":"2026-10-20T10:50:06Z","fixes":[{"ecosystem":"Hex","package":"coherence","fixed_in":["0.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Hex","package":"coherence","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"Hex","package":"coherence","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.2"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.2.0","0.3.0","0.3.1","0.4.0","0.5.0","0.5.1"]}],"products":[{"vendor":"coherence_project","product":"coherence"}],"references":[{"url":"https://github.com/smpallen99/coherence/issues/270","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20301","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mrq8-53r4-3j5m"},{"url":"https://github.com/smpallen99/coherence","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-20301","description":"An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, \"registration\" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.","status":"published","published":"2018-12-20T09:00:00Z","modified":"2024-08-05T11:58:18.82Z","updated_at":"2026-11-02T14:34:59.872731Z"}],"euvd":[{"id":"EUVD-2022-1108","description":"An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, \"registration\" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.","status":"published","published":"2018-12-20T09:00:00Z","modified":"2024-08-05T11:58:18Z","updated_at":"2026-11-03T02:39:31.423203Z"}],"ghsa":[{"id":"GHSA-mrq8-53r4-3j5m","title":"Permissive parameters and privilege escalation","description":"An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, \"registration\" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.","status":"published","published":"2022-02-10T22:35:39Z","modified":"2023-01-11T05:04:20Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:12.361159Z"}],"nvd":[{"id":"CVE-2018-20301","description":"An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, \"registration\" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.","status":"published","published":"2018-12-20T09:29:00.243Z","modified":"2026-06-17T01:52:35.003Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"CVE-2018-20301","description":"An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, \"registration\" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.","status":"published","published":"2018-12-20T09:29:00.243Z","modified":"2026-10-20T10:50:06.58043239Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"GHSA-mrq8-53r4-3j5m","title":"Permissive parameters and privilege escalation","description":"An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, \"registration\" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.","status":"published","published":"2022-02-10T22:35:39Z","modified":"2025-12-10T00:41:32.069367Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:52.170928Z"}]}}