CVE-2021-25976CWE-352

Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF)

High · published November 16, 2021

CVSS v3.1
8.1
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00456 · 38.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-11-16T09:05Z
EPSS history
Timeline
  • 16 NOV 09:05Z
    Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF)
    cvelistv5