Design/Logic Flaw

2018-09-1621:29:00

PRIOn knowledge base

www.prio-n.com

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.9%

JSON

DISPUTED An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator’s password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter.

CPENameOperatorVersion
getsimple_cmseq3.3.13

CPE	Name	Operator	Version
	getsimple_cms	eq	3.3.13

References

github.com/GetSimpleCMS/GetSimpleCMS/issues/1295