PT-2019-14746
CVE-2019-16660
·
تاريخ النشر
2019-09-21
·
تاريخ التحديث
2019-09-23
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
joyplus-cms version 1.6.0
Description
The issue concerns a CSRF vulnerability in the
admin ajax.php endpoint, specifically with the action=savexml and tab=vodplay parameters. This allows for potential unauthorized actions.Recommendations
For joyplus-cms version 1.6.0, consider implementing proper CSRF protection mechanisms, such as token-based validation, to prevent unauthorized requests to the
admin ajax.php endpoint. As a temporary workaround, restrict access to the admin ajax.php endpoint, especially for the savexml action and vodplay tab, until a proper fix is applied. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾