PT-2021-19454 · Unknown · B2Evolution Cms

Stacksmasher007 · Published 2021-12-06 · Updated 2021-12-07 · CVE-2021-31631

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions b2evolution CMS version 7.2.3

Description The issue is related to a Cross-Site Request Forgery (CSRF) in the User login page, allowing attackers to escalate privileges.

Recommendations For b2evolution CMS version 7.2.3, consider disabling the User login page until a patch is available to prevent potential privilege escalation. Restrict access to the login functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-31631

Affected Products

B2Evolution Cms

References · 5

• 🔥 https://gist.github.com/stacksmasher007/76514ab2b782fb4383f1121e6fc19241 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-31631 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31631 · Vendor Advisory
• https://t.me/cibsecurity/33412 · Telegram Post
• https://t.me/cvenotify/24321 · Telegram Post