CVE-2020-4040

2020-06-0822:15:10

Google

osv.dev

4.5 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.3%

JSON

Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview. This has been fixed in Bolt 3.7.1

CPENameOperatorVersion
bolteq0.9.5
bolteq3.3.2
bolteq3.4.3
bolteq3.6.0
bolteq3.6.7
bolteq3.6.0-beta.5
bolteq3.2.10
bolteq3.2.11
bolteq3.2.18
bolteq3.0.1