PT-2023-20817 · Churchcrm · Churchcrm

Published 2023-04-25 · Updated 2025-02-03 · CVE-2023-26841

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM version 4.5.3

Description A cross-site request forgery (CSRF) vulnerability allows attackers to change any user's password except for the user that is currently logged in.

Recommendations For ChurchCRM version 4.5.3, consider disabling password change functionality until a patch is available to prevent exploitation of the CSRF vulnerability. Restrict access to sensitive user management features to minimize the risk of unauthorized password changes.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-26841

Affected Products

Churchcrm

References · 7

• 🔥 https://github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-26841 · Exploit
• https://github.com/ChurchCRM/CRM · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26841 · Security Note
• https://t.me/cvenotify/109773 · Telegram Post
• https://t.me/cvenotify/49041 · Telegram Post
• https://t.me/cibsecurity/62805 · Telegram Post