Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1yN3cyLWo5NnYtdnc4bc4AA3ko
Cross-Site Request Forgery in JFinalCMS via /admin/slide/update
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.
Permalink: https://github.com/advisories/GHSA-r7w2-j96v-vw8mJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yN3cyLWo5NnYtdnc4bc4AA3ko
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 5 months ago
Updated: 5 months ago
CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Identifiers: GHSA-r7w2-j96v-vw8m, CVE-2023-49374
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-49374
- https://github.com/li-yu320/cms/blob/main/There%20is%20CSRF%20in%20the%20rotation%20image%20editing%20section.md
- https://github.com/advisories/GHSA-r7w2-j96v-vw8m
Blast Radius: 25.8
Affected Packages
maven:com.jfinal:jfinal
Dependent packages: 151Dependent repositories: 855
Downloads:
Affected Version Ranges: <= 5.0.0
No known fixed version
All affected versions: 1.4.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 4.9.7, 4.9.8, 4.9.9, 4.9.10, 4.9.11, 4.9.12, 4.9.13, 4.9.14, 4.9.15, 4.9.16, 4.9.17, 4.9.18, 4.9.19, 4.9.20, 4.9.21, 4.9.22, 4.9.23, 5.0.0