Cross-Site Request Forgery in Dedecms File Manager
CVE-2023-52047

8.8HIGH

Key Information:

Vendor

Dedecms

Status
Dedecms
Vendor
CVE Published:
28 February 2024

What is CVE-2023-52047?

Dedecms version 5.7.112 is susceptible to a Cross-Site Request Forgery (CSRF) attack within its file manager functionality. This vulnerability allows an attacker to perform unauthorized actions on behalf of a logged-in user without their consent. By crafting a malicious request, an attacker could exploit this weakness to manipulate files or configurations, posing a significant security risk to affected installations. Users are encouraged to review and apply appropriate security measures to mitigate the risks associated with this vulnerability.

References

https://github.com/chongfujun/test/blob/main/2023-52047.docx

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.