Lucene search

GitHub Advisory DatabaseGHSA-C7X2-7H8R-JQ4M

HistoryAug 25, 2022 - 12:00 a.m.

Kirby CMS 2.5.12 Cross-site Request Forgery

2022-08-2500:00:25

CWE-352

GitHub Advisory Database

github.com

kirby cms

csrf

vulnerability

delete page

remote attacker

malicious page

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

41.3%

JSON

An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force the user to delete a page.

Affected configurations

Vulners

Node

getkirbykirbyRange≤2.5.12

VendorProductVersionCPE
getkirbykirby*cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
getkirby	kirby	*	cpe:2.3:a:getkirby:kirby::::::::

References

zaranshaikh.blogspot.com

github.com/advisories/GHSA-c7x2-7h8r-jq4m

nvd.nist.gov/vuln/detail/CVE-2018-14519

www.exploit-db.com/exploits/45090

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

41.3%

JSON

Related for GHSA-C7X2-7H8R-JQ4M