Cross site request forgery (csrf)

2021-08-0319:15:00

PRIOn knowledge base

www.prio-n.com

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.2%

JSON

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim’s knowledge, by enticing an authenticated user to visit an attacker’s web page.

CPENameOperatorVersion
seeddmsge5.1.0
seeddmslt5.1.23
seeddmseq6.0.6 beta
seeddmsge6.0.7
seeddmslt6.0.16

Name	Operator	Version
seeddms	ge	5.1.0
seeddms	lt	5.1.23
seeddms	eq	6.0.6 beta
seeddms	ge	6.0.7
seeddms	lt	6.0.16

References

medium.com/@cyberdivision/cve-2021-36542-a07585497eb8