CVE-2024-38457

Exploit

EPSS 6.56%
Veröffentlicht 16.06.2024 15:15:51
Zuletzt bearbeitet 21.11.2024 09:25:56
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

Xenforo before 2.2.16 allows CSRF.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Xenforo ≫ Xenforo Version < 2.2.16

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	6.56%	0.908

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

http://seclists.org/fulldisclosure/2024/Jul/11

Third Party Advisory

Exploit

Mailing List

https://xenforo.com/community/threads/xenforo-2-1-15-patch-1-2-2-16-patch-2-and-xenforo-media-gallery-2-1-9-2-2-6-released-includes-security-fixes.222133/

Patch

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2024-38457

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-38457

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-38457

EUVD