CVE-2023-49398

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/category/delete...

cc.ecore:spring-jfinal (=0.0.1), cc.ecore:spring-jfinal-plugin (>=0.1.0 <=0.1.2) +164 more potentially affected by CVE-2023-49398 via com.jfinal:jfinal (>=1.4 <=5.0.0)

com.jfinal:jfinal MAVEN version =1.4, =0.1.0, =0.1.1, =1.0.2, =1.0.0, =1.0, =3.30.7-RELEASE, =0.0.8, =0.0.8, =0.0.8, =1.29.1.trial, =1.29.1.trial, =1.45.0 - cn.dreampie:jfinal-akka =0.1 and more Source cves: CVE-2023-49398 Source advisory: OSV:GHSA-MWVQ-GC5W-M78F...

CVE-2023-49398

JFinalCMS 5.0.0 contains a CSRF vulnerability exploitable via the /admin/category/delete endpoint. The CVE-2023-49398 entry notes CSRF with high impact (confidentiality/ integrity/ availability affected) and no exploitation details are provided in the connected documents. The linked PT-2023-31204...