PT-2026-26081 · Mura Cms · Mura Cms

CVE-2025-55043 · Publicado 2026-03-18 · Atualizado 2026-03-18

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MuraCMS versions through 10.1.10

Description MuraCMS installations are susceptible to a Cross-Site Request Forgery (CSRF) issue within the bundle creation functionality, specifically the csettings.cfc createBundle method. This allows unauthenticated attackers to compel administrators to generate and store site bundles—containing sensitive data—in publicly accessible directories. The compromised data includes user accounts, password hashes, form submissions, email lists, plugins, and site content. The attack operates without the administrator’s knowledge, enabling complete data exfiltration. The createBundle method is vulnerable to exploitation.

Recommendations Versions prior to 10.1.10 should be updated.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2025-55043

Produtos afetados

Mura Cms

Referências · 4

• https://murasoftware.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-55043 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034365324162982178 · Publicação no Twitter
• https://docs.murasoftware.com/v10/release-notes/#section-version-1014 · Nota