Cross-Site Request Forgery in DedeCMS Affects Version 5.7
CVE-2024-28673

8.8HIGH

Key Information:

Vendor

DedeCMS

Status
DedeCMS
Vendor
CVE Published:
13 March 2024

What is CVE-2024-28673?

DedeCMS version 5.7 has been found to have a Cross-Site Request Forgery (CSRF) flaw that can be exploited through the endpoint /dede/mychannel_edit.php. This vulnerability allows unauthorized commands to be executed on behalf of a user without their consent, potentially compromising the security of the affected site. Attackers can leverage this vulnerability to manipulate user actions, which may result in unauthorized changes or data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/777erp/cms/blob/main/4.md

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.