ExploitCVE-2024-9281
Cross-Site Request Forgery (CSRF) (CWE-352)
Summary
A vulnerability classified as problematic has been discovered in bg5sbk MiniCMS versions up to 1.11. The issue affects unknown processing in the file post-edit.php, leading to cross-site request forgery (CSRF). This vulnerability can be exploited remotely and requires user interaction. The exploit has been publicly disclosed and may be actively used.
Impact
If successfully exploited, this vulnerability could allow an attacker to perform actions on behalf of an authenticated user without their knowledge or consent. The primary impact is on the integrity of the system, with a low severity. There is no direct impact on confidentiality or availability of the system. The CVSS v3.1 base score is 4.3 (Medium), while the CVSS v4.0 base score is 6.9 (Medium).
Exploitation
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patch
As of the latest information provided, there is no mention of an available patch. The vendor was contacted about this disclosure but did not respond, suggesting that a patch may not be currently available.
Mitigation
1. Implement CSRF tokens in all forms and state-changing requests. 2. Use the SameSite cookie attribute to limit the scope of session cookies. 3. Implement proper Cross-Origin Resource Sharing (CORS) policies. 4. Educate users about the risks of clicking on untrusted links while authenticated to the application. 5. Consider updating to a newer version of the CMS if one becomes available that addresses this vulnerability. 6. Monitor for any vendor responses or patch releases related to this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
NVD published the first details for CVE-2024-9281
Feedly found the first article mentioning CVE-2024-9281. See article
Feedly estimated the CVSS score as HIGH
Feedly estimated the CVSS score as MEDIUM
Feedly estimated the CVSS score as HIGH
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.05% (Percentile: 16.3%)