PT-2021-18051 · Unknown · Cms Papoo Light+1

Reinhard Westerholt · Published 2021-04-13 · Updated 2021-04-21 · CVE-2021-29054

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Papoo CMS Light versions through 21.02 Papoo CMS Pro versions through 6.0.1

Description: The issue is related to Cross Site Request Forgery (CSRF) in the admin interface, allowing for remote privilege gain.

Recommendations: For Papoo CMS Light versions through 21.02, update to a version later than 21.02 to resolve the issue. For Papoo CMS Pro versions through 6.0.1, update to a version later than 6.0.1 to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-29054

Affected Products

Cms Papoo Light

Papoo Cms Pro

References · 6

• https://papoo.de/achtung---sicherheitsfeature-bitte-aktivieren.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29054 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29054 · Vendor Advisory
• https://packetstormsecurity.com/files/162077/Papoo-CMS-Cross-Site-Request-Forgery.html · Note
• https://github.com/raginx/security/blob/main/rADV-2021-01.txt · Note
• https://t.me/cvenotify/13138 · Telegram Post