PT-2024-19497 · Flycms · Flycms
CVE-2024-22592
·
Published
2024-01-18
·
Updated
2024-01-20
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FlyCms version 1.0
Description
The issue is a Cross-Site Request Forgery (CSRF) vulnerability. It can be exploited via the
/system/user/group update API endpoint.Recommendations
For FlyCms version 1.0, as a temporary workaround, consider restricting access to the
/system/user/group update API endpoint until a patch is available. Avoid using this endpoint in scenarios where CSRF attacks are possible.Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flycms