PT-2017-18889 · Bigtree · Bigtree Cms

Xfkxfk · Published 2017-06-02 · Updated 2017-06-06 · CVE-2017-9379

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19

Description The issue concerns multiple CSRF problems. Specifically, the clear parameter to "core/admin/modules/dashboard/vitals-statistics/404/clear.php" and the from or to parameters to "core/admin/modules/dashboard/vitals-statistics/404/create-301.php" are affected.

Recommendations For BigTree CMS versions prior to 4.2.19, update to version 4.2.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the "core/admin/modules/dashboard/vitals-statistics/404/clear.php" and "core/admin/modules/dashboard/vitals-statistics/404/create-301.php" endpoints to minimize the risk of exploitation. Avoid using the clear, from, and to parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-9379

Affected Products

Bigtree Cms

References · 4

• 🔥 https://github.com/bigtreecms/BigTree-CMS/issues/287 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9379 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9379 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9379 · Note