PT-2020-6426

CVE-2020-36389

Published

2020-08-10

Updated

2024-03-06

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CiviCRM versions prior to 5.28.1 CiviCRM ESR versions prior to 5.27.5 ESR

Description The issue is related to the CKEditor configuration form in CiviCRM, which allows Cross-Site Request Forgery (CSRF). This could potentially allow a remote attacker to impact data integrity.

Recommendations For CiviCRM versions prior to 5.28.1, update to version 5.28.1 or later. For CiviCRM ESR versions prior to 5.27.5 ESR, update to version 5.27.5 ESR or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Dennis Brinkrolf

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers

CVE-2020-36389