PT-2017-6814 · Django · Django Cms

Matthew Wilkes + 1 · Publicado 2017-08-18 · Atualizado 2022-05-17 · CVE-2015-5081

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions django CMS versions 3.0.0 through 3.0.13 django CMS versions 3.1.0 through 3.1.0

Description A cross-site request forgery (CSRF) issue allows remote attackers to manipulate privileged users into performing unknown actions via unspecified vectors.

Recommendations For django CMS versions 3.0.0 through 3.0.13, update to version 3.0.14 or later. For django CMS versions 3.1.0 through 3.1.0, update to version 3.1.1 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-5081

GHSA-2PQC-GV8Q-PVQV

PYSEC-2017-11

Produtos afetados

Django Cms

Referências · 8

• https://github.com/divio/django-cms/commit/f77cbc607d6e2a62e63287d37ad320109a2cc78a · Nota
• https://github.com/django-cms/django-cms/commit/f77cbc607d6e2a62e63287d37ad320109a2cc78a · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django-cms/PYSEC-2017-11.yaml · Nota
• https://django-cms.org/en/blog/2015/06/27/311-3014-release · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2017-11 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5081 · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/06/28/1 · Nota
• https://osv.dev/vulnerability/GHSA-2pqc-gv8q-pvqv · Aviso do Fabricante