ExploitCVE-2024-7106
Cross-Site Request Forgery (CSRF) (CWE-352)
Summary
A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/media_folders. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vulnerability affects an unknown functionality of the file /admin/media_folders and can lead to cross-site request forgery (CSRF). The attack can be launched remotely, and user interaction is required.
Impact
This vulnerability allows an attacker to perform cross-site request forgery attacks, which could lead to unauthorized actions being performed on behalf of authenticated users. The CVSS v3.1 base score is 8.8 (High severity), with high impact on integrity, confidentiality, and availability. The attack vector is network-based, has low attack complexity, requires no privileges, but does require user interaction.
Exploitation
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patch
As of the current information, there is no mention of an available patch. The vendor (Denkgroot) was contacted early about this disclosure but did not respond in any way.
Mitigation
While no specific mitigation strategies are provided, general CSRF mitigation techniques should be applied. These may include implementing anti-CSRF tokens, checking the Referer header, and using SameSite cookie attribute. Additionally, consider limiting or disabling access to the affected functionality in /admin/media_folders until a patch is available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
Feedly found the first article mentioning CVE-2024-7106. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-7106
A CVSS base score of 4.3 has been assigned.
This CVE started to trend in security discussions
EPSS Score was set to: 0.05% (Percentile: 16.1%)
This CVE stopped trending in security discussions
A CVSS base score of 8.8 has been assigned.