CVE-2020-4040CWE-352

CSRF issue on preview pages in Bolt CMS

High · published June 8, 2020

CVSS v3.1
8.6
EPSS
2%
Percentile
77.9
In the wild
Unconfirmed
What it is

Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview. This has been fixed in Bolt 3.7.1

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01766 · 77.9th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2020-06-08T22:00Z
EPSS history
Timeline
  • 08 JUN 22:00Z
    CSRF issue on preview pages in Bolt CMS
    cvelistv5