Cross-Site Request Forgery in PiranhaCMS

2021-11-1723:42:40

Google

osv.dev

0.001 Low

EPSS

Percentile

30.2%

JSON

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.

CPENameOperatorVersion
piranhaeq9.0.1
piranhaeq4.1.0-alpha1
piranhaeq7.0.3
piranhaeq5.1.1
piranhaeq4.1.0-beta2
piranhaeq8.4.1
piranhaeq8.0.2
piranhaeq4.0.0-alpha4
piranhaeq5.1.0
piranhaeq5.4.0

Name	Operator	Version
piranha	eq	9.0.1
piranha	eq	4.1.0-alpha1
piranha	eq	7.0.3
piranha	eq	5.1.1
piranha	eq	4.1.0-beta2
piranha	eq	8.4.1
piranha	eq	8.0.2
piranha	eq	4.0.0-alpha4
piranha	eq	5.1.0
piranha	eq	5.4.0