PT-2022-8035 · Kirby · Kirby

Zaran Shaikh · Published 2022-08-24 · Updated 2022-08-29 · CVE-2018-14519

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kirby version 2.5.12

Description The delete page functionality in Kirby suffers from a CSRF flaw, allowing a remote attacker to craft a malicious page and force the user to delete a page.

Recommendations For Kirby version 2.5.12, consider disabling the delete page functionality until a patch is available to prevent exploitation of the CSRF flaw. Restrict access to the delete page feature to minimize the risk of unauthorized page deletion.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-14519

GHSA-C7X2-7H8R-JQ4M

Affected Products

Kirby

References · 7

• 🔥 http://zaranshaikh.blogspot.com · Exploit
• 🔥 https://exploit-db.com/exploits/45090 · Exploit
• https://osv.dev/vulnerability/CVE-2018-14519 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c7x2-7h8r-jq4m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14519 · Security Note
• https://github.com/getkirby/kirby · Note
• https://t.me/cibsecurity/48685 · Telegram Post