CVE-2020-26522

Опубликовано: 09 окт. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

A cross-site request forgery (CSRF) vulnerability in mod/user/act_user.php in Garfield Petshop through 2020-10-01 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts.

Ссылки

http://packetstormsecurity.com/files/159520/Garfield-Petshop-2020-10-01-Cross-Site-Request-Forgery.html
Third Party Advisory
http://rysec.io/adv/Petshop_AddAdmin_Exploit.txt
Exploit
Third Party Advisory
URL Repurposed
https://demo.detapos.co.id/petshop/
Permissions Required
Third Party Advisory
https://detapos.co/
Third Party Advisory
http://packetstormsecurity.com/files/159520/Garfield-Petshop-2020-10-01-Cross-Site-Request-Forgery.html
Third Party Advisory
http://rysec.io/adv/Petshop_AddAdmin_Exploit.txt
Exploit
Third Party Advisory
URL Repurposed
https://demo.detapos.co.id/petshop/
Permissions Required
Third Party Advisory
https://detapos.co/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:garfield_petshop_project:garfield_petshop:*:*:*:*:*:*:*:*

Версия до 2020-10-01 (включая)

EPSS

Процентиль: 33%

0.00133

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-77p7-xmff-w3pm

github

больше 3 лет назад