getkirby/kirby · Security
Kirby CMS 2.5.12 Cross-site Request Forgery
- GHSA ID
- GHSA-c7x2-7h8r-jq4m
- CVE ID
- CVE-2018-14519
- Severity
- medium
- Published
- Updated
- CVSS
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- CVSS v3
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Description
An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force the user to delete a page.
CWEs
- CWE-352 · Cross-Site Request Forgery (CSRF)