Cross Site Request Forgery in yzCMS by YZMCMS
CVE-2020-20502

6.5MEDIUM

Key Information:

Vendor

Yzmcms

Status
Yzmcms
Vendor
CVE Published:
20 June 2023

What is CVE-2020-20502?

A vulnerability exists in version 2.0 of yzCMS that allows attackers to exploit a Cross Site Request Forgery (CSRF) flaw. This weakness enables a remote attacker to execute arbitrary code through the token check function, posing a significant risk to the security of affected installations. It is recommended that users of yzCMS upgrade to a patched version to mitigate this risk effectively.

References

http://www.yzmcms.com/
https://github.com/yzmcms/yzmcms/issues/27

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.