Cross-Site Request Forgery (CSRF)

2022-03-2511:28:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

21.4%

JSON

anchorcms/anchor-cms is vulnerable to cross-site request forgery. The vulnerability exists because the token is not checked when deleting the posts in posts.php which allows an attacker to arbitrarily delete the posts.

CPENameOperatorVersion
anchorcms/anchor-cmseq0.12.7
anchorcms/anchor-cmseq0.12.7

CPE	Name	Operator	Version
	anchorcms/anchor-cms	eq	0.12.7
	anchorcms/anchor-cms	eq	0.12.7

References

github.com/anchorcms/anchor-cms

github.com/anchorcms/anchor-cms/blob/0.12.7/anchor/routes/posts.php#L341

github.com/butterflyhack/anchorcms-0.12.7-CSRF

0.001 Low

EPSS

Percentile

21.4%

JSON

Related for VERACODE:34832