6.5
CVE-2021-29400
- EPSS 0.11%
- Veröffentlicht 10.08.2021 23:15:07
- Zuletzt bearbeitet 21.11.2024 06:01:02
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginA cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change the SMTP settings of the contact forms for the webpages of the CMS after an authenticated admin visits a malicious third-party site.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netexplorer ≫ My Smtp Contact Version1.1.1 SwPlatformgetsimple
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.11% | 0.26 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.