DedeCMS v5.7 vulnerable to CSRF via catalog_del.php
CVE-2024-28431

8.8HIGH

Key Information:

Vendor

DedeCMS

Status
Dedecms
Vendor
CVE Published:
13 March 2024

What is CVE-2024-28431?

DedeCMS v5.7 is affected by a security flaw that allows attackers to exploit a Cross-Site Request Forgery (CSRF) vulnerability via the /dede/catalog_del.php component. This vulnerability can lead to unauthorized actions being performed on behalf of a user without their consent, posing significant risks to data integrity and user privacy. It is critical for administrators to apply necessary updates to mitigate this issue.

References

https://github.com/itsqian797/cms/blob/main/3.md

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.