Cross Site Request Forgery Vulnerability in FUEL-CMS by Daylight Studio
CVE-2021-36570

8.8HIGH

Key Information:

Vendor: Thedaylightstudio
Status: Fuel Cms
Vendor: CVE Published:; 3 February 2023

🔔 Create Thedaylightstudio Vulnerability Alert

What is CVE-2021-36570?

The Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 enables remote attackers to exploit the system by manipulating POST requests to the /permissions/delete/2 endpoint, allowing unauthorized execution of arbitrary code. This can lead to significant security breaches, making it crucial for users to apply necessary updates and patches to secure their applications.

References

https://github.com/daylightstudio/FUEL-CMS/issues/579

CVSS V3.1

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Feb 3, 2023
Vulnerability Reserved
Jul 12, 2021

CVE-2021-36570 Data

JSON