PT-2023-30689 · Unknown · Dreamer Cms

Published 2023-11-13 · Updated 2023-11-16 · CVE-2023-48063

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions dreamer cms version 4.1.3

Description An issue was discovered that allows for a CSRF vulnerability, enabling the deletion of a theme project via the "admin/category/delete" API endpoint.

Recommendations For dreamer cms version 4.1.3, consider disabling access to the "admin/category/delete" endpoint until a patch is available to prevent exploitation of the CSRF vulnerability.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-48063

Affected Products

Dreamer Cms

References · 3

• 🔥❌ https://github.com/CP1379767017/cms/blob/dreamcms_vul/There%20is%20a%20CSRF%20vulnerability%20at%20th%20menu%20management%20location.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-48063 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48063 · Vendor Advisory