PT-2024-17558 · Jfinalcms · Jfinalcms

Hadagaga + 1 · Published 2024-12-08 · Updated 2024-12-11 · CVE-2024-12349

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JFinalCMS version 1.0

Description The issue is related to a cross-site request forgery (CSRF) vulnerability in the /admin/tag/save file of the JFinalCMS system. This vulnerability can be exploited remotely, allowing an attacker to perform a CSRF attack. The exploit has been disclosed to the public and may be used.

Recommendations For JFinalCMS version 1.0, as a temporary workaround, consider disabling access to the /admin/tag/save file until a patch is available. Restrict access to the administrative panel to minimize the risk of exploitation. Avoid using the affected functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

BDU:2025-01101

CVE-2024-12349

Affected Products

Jfinalcms

References · 12

• 🔥 https://github.com/hadagaga/vuln/blob/master/JFinalCMS/Cross_Site_Request_Forgery/Cross-Site-Request-Forgery.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12349 · Security Note
• https://bdu.fstec.ru/vul/2025-01101 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12349 · Vendor Advisory
• https://vuldb.com/?submit.456042 · Note
• https://t.me/cvedetector/12338 · Telegram Post
• https://vuldb.com/?id.287269 · Note
• https://twitter.com/CVEnew/status/1865925927051399581 · Twitter Post
• https://twitter.com/dailycve/status/1866929579136340276 · Twitter Post
• https://vuldb.com/?ctiid.287269 · Note
• https://twitter.com/VulmonFeeds/status/1865944096101073176 · Twitter Post
• https://t.me/cvenotify/103482 · Telegram Post