CSRF Vulnerability in CiviCRM Affects CKEditor Configuration
CVE-2020-36389

4.3MEDIUM

Key Information:

Vendor

Civicrm

Status
Civicrm
Vendor
CVE Published:
17 June 2021

What is CVE-2020-36389?

A CSRF vulnerability in CiviCRM's CKEditor configuration form allows attackers to perform unauthorized actions without user consent in versions prior to 5.28.1 and 5.27.5 ESR. This could lead to potential manipulation of user settings and compromised application integrity, emphasizing the importance of implementing security best practices to safeguard web applications.

References

https://civicrm.org/advisory/civi-sa-2020-11-csrf-ckedito...
https://blog.sonarsource.com/civicrm-code-execution-vulne...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.