Lucene search

MitreCVE-2023-37131

HistoryJul 06, 2023 - 3:15 p.m.

CVE-2023-37131

2023-07-0615:15:16

CWE-352

mitre

web.nvd.nist.gov

cve-2023-37131

cross-site request forgery

csrf

yzncms v1.1.0

administrator password

security vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

24.9%

JSON

A Cross-Site Request Forgery (CSRF) in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers to arbitrarily change the Administrator password via a crafted POST request.

Affected configurations

Nvd

Node

yzncmsyzncmsMatch1.1.0

VendorProductVersionCPE
yzncmsyzncms1.1.0cpe:2.3:a:yzncms:yzncms:1.1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
yzncms	yzncms	1.1.0	cpe:2.3:a:yzncms:yzncms:1.1.0:::::::*

References

github.com/ken678/yzncms/issues/2

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

24.9%

JSON

Related for CVE-2023-37131