CVE-2022-40489

HIGH8.8EPSS 0.13%

ThinkCMF Cross Site Request Forgery (CSRF) vulnerability

發布日:2022/12/1修改日:2024/4/25

描述

ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.

受影響套件(1)

Packagist/thinkcmf/thinkcmffrom 0, < 6.0.8

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-40489
PATCHhttps://github.com/thinkcmf/thinkcmf
WEBhttps://github.com/thinkcmf/thinkcmf/commit/321faa20865e74540e5f0a63e4c3f4ea75093d59
WEBhttps://github.com/thinkcmf/thinkcmf/commit/b61636134aa57d4693967f35772200c779099740
WEBhttps://github.com/thinkcmf/thinkcmf/issues/736