PT-2024-38079 · Spina Cms · Spina Cms

Published 2024-07-25 · Updated 2024-08-14 · CVE-2024-7106

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Spina CMS version 2.18.0

Description A problematic vulnerability was found in Spina CMS, affecting an unknown functionality of the file /admin/media folders. This leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public.

Recommendations For Spina CMS version 2.18.0, consider disabling access to the /admin/media folders file as a temporary workaround until a patch is available. Restrict access to this functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-7106

GHSA-WQW3-P83G-R24V

Affected Products

Spina Cms

References · 12

• 🔥 https://github.com/topsky979/Security-Collections/blob/main/cve3/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-7106 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wqw3-p83g-r24v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7106 · Security Note
• https://github.com/SpinaCMS/Spina · Note
• https://twitter.com/it_malibu/status/1823819393434051020 · Twitter Post
• https://t.me/cvedetector/1651 · Telegram Post
• https://vuldb.com/?id.272431 · Note
• https://vuldb.com/?submit.376769 · Note
• https://vuldb.com/?ctiid.272431 · Note
• https://t.me/cvenotify/90302 · Telegram Post
• https://rubysec.com/advisories/CVE-2024-7106 · Note