Lucene search

K
nvd[email protected]NVD:CVE-2022-37730
HistorySep 07, 2022 - 3:15 p.m.

CVE-2022-37730

2022-09-0715:15:08
CWE-352
web.nvd.nist.gov
3
ftcms 2.1
cross site request forgery
php page
identity authentication
unauthorized requests

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

43.4%

In ftcms 2.1, there is a Cross Site Request Forgery (CSRF) vulnerability in the PHP page, which causes the attacker to forge a link to trick him to click on a malicious link or visit a page containing attack code, and send a request to the server (corresponding to the identity authentication information) as the victim without the victim’s knowledge.

Affected configurations

Nvd
Node
ftcmsftcmsMatch2.1
VendorProductVersionCPE
ftcmsftcms2.1cpe:2.3:a:ftcms:ftcms:2.1:*:*:*:*:*:*:*

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

43.4%

Related for NVD:CVE-2022-37730