CVE-2024-9847: fallo de gravedad alta en flatpressblog/flatpress
Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8epss 0.3%
FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a request to the FlatPress CMS server to perform the desired action on behalf of the victim user. Since the request is authenticated, the server will process it as if it were initiated by the legitimate user, effectively allowing the attacker to perform unauthorized actions. This vulnerability is fixed in version 1.4.dev.
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Productos afectados
flatpressblog · flatpressblog/flatpressCVEs relacionadas — flatpressblog/flatpress
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-4606HIGHPHP Remote File Inclusion in flatpressblog/flatpressEPSS 35.4%CVE-2023-0947HIGHPath Traversal in flatpressblog/flatpressEPSS 3.6%CVE-2024-4023HIGHStored XSS in flatpressblog/flatpressEPSS 0.8%CVE-2023-1105HIGHExternal Control of File Name or Path in flatpressblog/flatpressEPSS 0.7%CVE-2023-1104HIGHCross-site Scripting (XSS) - Stored in flatpressblog/flatpressEPSS 0.6%CVE-2023-1106MEDIUMCross-site Scripting (XSS) - Reflected in flatpressblog/flatpressEPSS 0.6%