PT-2020-20560
CVE-2020-9266
·
Published
2020-02-18
·
Updated
2020-02-19
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
SOPlanning version 1.45
Description
The issue allows for a CSRF attack, enabling arbitrary changes to the admin password through the "process/xajax server.php" endpoint.
Recommendations
For SOPlanning version 1.45, consider restricting access to the "process/xajax server.php" endpoint to minimize the risk of exploitation. As a temporary workaround, implement CSRF protection measures until a patch is available.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾