PT-2018-9805
CVE-2018-10295
·
Publicado
2018-04-22
·
Atualizado
2018-05-25
Descrição por
CVSS 3.1
8.8
AltaMétricasAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
ChemCMS version 1.0.6
Description:
The issue allows for CSRF by utilizing the "public/admin/user/addpost.html" endpoint to add an administrator account.
Recommendations:
For ChemCMS version 1.0.6, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions, such as adding administrator accounts through the "public/admin/user/addpost.html" endpoint. As a temporary workaround, restrict access to this endpoint until a proper fix is applied.
Explorabilidade
Exploit
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾