PT-2023-31186 · Jfinalcms · Jfinalcms

CVE-2023-49372 · Publicado 2023-12-05 · Atualizado 2023-12-09

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JFinalCMS version 5.0.0

Description A Cross-Site Request Forgery (CSRF) issue was discovered in JFinalCMS. The vulnerability can be exploited via the /admin/slide/save API endpoint.

Recommendations For JFinalCMS version 5.0.0, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the /admin/slide/save endpoint to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-49372

GHSA-9WVJ-WR2F-6MX6

Produtos afetados

Jfinalcms

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49372.json · Exploit
• 🔥 https://github.com/li-yu320/cms/blob/main/There%20is%20a%20CSRF%20present%20at%20the%20new%20location%20of%20the%20rotation%20image.md · Exploit
• https://github.com/jfinal/jfinal · Nota
• https://t.me/cvenotify/62315 · Publicação no Telegram
• https://t.me/cvenotify/63066 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1732097012672123050 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-49372 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-9wvj-wr2f-6mx6 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1732045149331677261 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-49372 · Aviso do Fabricante