PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5594 Pagekit CVE debrief

CVE-2017-5594 was published on 2017-01-25 and describes a password-reset weakness in Pagekit CMS before 1.0.11 when the debug toolbar is enabled. NVD rates the issue HIGH with a 7.5 score and maps it to CWE-640. The documented fix is available in the Pagekit commit referenced by NVD, and the official CVE/NVD records confirm the affected version range.

Vendor
Pagekit
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-25
Original CVE updated
2026-05-13
Advisory published
2017-01-25
Advisory updated
2026-05-13

Who should care

Organizations running Pagekit CMS 1.0.10 or earlier, especially any deployment where the debug toolbar may be enabled or reachable in production. Administrators responsible for account security and application hardening should treat this as a priority.

Technical summary

NVD lists Pagekit CMS versions up to and including 1.0.10 as vulnerable. The issue is described as a remote attacker being able to reset a registered user's password when the debug toolbar is enabled, which can lead to account compromise. The NVD CVSS vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting network reachability, required user interaction, and high impact. NVD assigns CWE-640 (Weak Password Recovery Mechanism for Forgotten Password).

Defensive priority

High for any exposed or actively used Pagekit deployment on affected versions, because the impact is account takeover and the fix is version-based. Priority is especially high if the debug toolbar cannot be confirmed disabled in all environments.

Recommended defensive actions

  • Upgrade Pagekit CMS to version 1.0.11 or later.
  • Disable the debug toolbar in production and confirm it is not exposed to unauthenticated users.
  • Review account and password-reset activity for unexpected changes on affected systems.
  • Validate that no affected Pagekit instances remain in staging, test, or forgotten deployments.
  • Use the vendor patch commit and NVD record to confirm remediation scope before and after upgrade.

Evidence notes

CVE and NVD records both list Pagekit CMS before 1.0.11 as affected. The NVD entry published with the CVE gives CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H and CWE-640. The NVD reference list includes a Pagekit commit identified as the patch, a SecureLayer7 technical report, and third-party exploit references; this debrief relies on the official records and patch reference for defensive guidance. Published date used here is the CVE publish timestamp from the supplied timeline, not the later source modification timestamp.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5594 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5594

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5594 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5594

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.