PT-2017-18889 · Bigtree · Bigtree Cms

Xfkxfk · Publicado 2017-06-02 · Atualizado 2017-06-06 · CVE-2017-9379

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19

Description The issue concerns multiple CSRF problems. Specifically, the clear parameter to "core/admin/modules/dashboard/vitals-statistics/404/clear.php" and the from or to parameters to "core/admin/modules/dashboard/vitals-statistics/404/create-301.php" are affected.

Recommendations For BigTree CMS versions prior to 4.2.19, update to version 4.2.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the "core/admin/modules/dashboard/vitals-statistics/404/clear.php" and "core/admin/modules/dashboard/vitals-statistics/404/create-301.php" endpoints to minimize the risk of exploitation. Avoid using the clear, from, and to parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-9379

Produtos afetados

Bigtree Cms

Referências · 4

• 🔥 https://github.com/bigtreecms/BigTree-CMS/issues/287 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9379 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9379 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9379 · Aviso do Fabricante