Security readout for executives and security teams
Plain-English summary
doorGets 7.0 has a cross-site request forgery issue in its user-add function that can result in creation of an administrator account. For a business, the concern is unauthorized administrative access to a CMS. The sources do not provide CVSS scoring, patch status, or evidence of active exploitation.
Executive priority
Treat this as a high-priority legacy CMS exposure if doorGets 7.0 is present. The business risk is unauthorized CMS administration, but urgency depends on whether the product is deployed, exposed, and still used.
Technical view
The CVE describes CSRF in dg-user/?controller=users&action=add in doorGets 7.0, with the security impact stated as adding an administrator account. CSRF generally abuses a trusted user session, but the provided sources do not detail prerequisites, authentication state, proof-of-concept conditions, or remediation.
Likely exposure
Exposure is most likely limited to organizations running doorGets CMS 7.0 with the administrative user-management route reachable. The source bundle does not provide CPEs, vendor metadata, deployment details, or affected version ranges beyond doorGets 7.0.
Exploitation context
CISA KEV is false, and the provided sources do not state active exploitation. Public context is sparse: the CVE and linked GitHub issue identify the vulnerable route and outcome, but not real-world abuse, exploit maturity, or patch availability.
Researcher notes
The record is thin: no CVSS, CWE, CPE, patch reference, or KEV listing is provided. Base assessment on the stated impact, validate the exact product/version locally, and avoid assuming broader affected versions without vendor evidence.
Mitigation direction
- Check doorGets vendor or project guidance for a fixed version or supported remediation.
- Restrict access to administrative paths to trusted networks or authenticated administrators.
- Review user-management workflows for anti-CSRF protections before continued use.
- Remove unused doorGets installations or isolate legacy CMS deployments.
- Audit administrator accounts for unknown or recently created users.
Validation and detection
- Identify whether any internet-facing assets run doorGets CMS 7.0.
- Confirm whether dg-user user-management routes are reachable from untrusted networks.
- Review application code or configuration for CSRF tokens on user creation.
- Check CMS user records for unexpected administrator accounts.
- Document findings because official version and patch details are incomplete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-11126 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/doorgets/CMS/issues/11CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.