Lucene search
Nguyen Anh TienWPVDB-ID:A72A5BE4-654B-496F-94CD-3814C0E40120HistorySep 06, 2020 - 12:00 a.m.
ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings
2020-09-0600:00:00
Nguyen Anh Tien
wpscan.com
8
0.001 Low
EPSS
Percentile
27.5%
The ActiveCampaign 8.0.1 plugin is lacking CSRF check on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker’s account.
PoC
When a logged-in administrator accesses an HTML page embedded below content, the plugin’s setting will be changed.
| CPE | Name | Operator | Version |
|---|---|---|---|
| activecampaign-subscription-forms | lt | 8.0.2 |
Related
cve
cve
CVE-2021-24133
2021-03-18 15:15:14
cvelist
cvelist
prion
prion
Cross site request forgery (csrf)
2021-03-18 15:15:00
nvd
nvd
CVE-2021-24133
2021-03-18 15:15:14
wpexploit
wpexploit
ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings
2020-09-06 00:00:00