PT-2020-15595 · Getsimple Cms · Getsimple Cms Multi User Plugin

Boku + 1 · Published 2020-09-25 · Updated 2020-10-08 · CVE-2020-23837

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GetSimple CMS Multi User plugin version 1.8.2

Description A Cross-Site Request Forgery (CSRF) issue allows remote attackers to add admin or other users after an authenticated admin visits a third-party site or clicks on a URL. This occurs because the plugin fails to properly validate requests, enabling attackers to perform unauthorized actions.

Recommendations For GetSimple CMS Multi User plugin version 1.8.2, consider disabling the plugin until a patch is available to prevent exploitation of this issue. Restrict access to admin panels and ensure that all administrators are cautious when clicking on external links or visiting third-party sites to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-23837

Affected Products

Getsimple Cms Multi User Plugin

References · 4

• 🔥 https://exploit-db.com/exploits/48745 · Exploit
• https://osv.dev/vulnerability/CVE-2020-23837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23837 · Security Note
• http://get-simple.info/extend/plugin/multi-user/133 · Note