Lucene search

Japan Vulnerability NotesJVN:58407606

HistoryNov 12, 2021 - 12:00 a.m.

JVN#58407606: Unlimited Sitemap Generator vulnerable to cross-site request forgery

2021-11-1200:00:00

Japan Vulnerability Notes

jvn.jp

sitemap generator

csrf vulnerability

update software

xml-sitemaps

cwe-352

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

52.4%

JSON

Unlimited Sitemap Generator provided by XML-Sitemaps contains a cross-site request forgery vulnerability (CWE-352).

Impact

If a user views a malicious page while logged in, unintended operations may be performed.

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.
The developer released Unlimited Sitemap Generator v8.2 that contains a fix for this vulnerability.

Products Affected

Unlimited Sitemap Generator versions prior to v8.2

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

52.4%

JSON

Related for JVN:58407606