CVE-2021-36569

Name of the Vulnerable Software and Affected Versions FUEL-CMS version 1.4.13

Description The issue allows remote attackers to run arbitrary code via post ID to the "/users/delete/2" API endpoint. This is a Cross Site Request Forgery vulnerability.

Recommendations For FUEL-CMS version 1.4.13, as a temporary workaround, consider restricting access to the "/users/delete/2" API endpoint until a patch is available. Avoid using the post ID parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.