CVE-2022-26173

Опубликовано: 16 июн. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target_host:port/jforum-2.8.0/jforum.page, which allows attackers to arbitrarily add admin accounts.

Ссылки

http://jforum.com
Product
https://community.jforum.net/posts/list/248.page
Mailing List
Release Notes
Vendor Advisory
https://github.com/WULINPIN/CVE/blob/main/JForum/poc.html
Exploit
Third Party Advisory
https://jforum.net/
Product
https://sourceforge.net/p/jforum2/wiki2/NewFeatures281/
Third Party Advisory
http://jforum.com
Product
https://community.jforum.net/posts/list/248.page
Mailing List
Release Notes
Vendor Advisory
https://github.com/WULINPIN/CVE/blob/main/JForum/poc.html
Exploit
Third Party Advisory
https://jforum.net/
Product
https://sourceforge.net/p/jforum2/wiki2/NewFeatures281/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jforum:jforum:2.8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 44%

0.00214

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-cvq7-wjgx-9gr8