CVE-2021-37366

HIGH

8.8

Description

CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick the administrator into clicking a link that cancels the filtering for all standard users.

Details CVE

Score CVSS v3.18.8

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie8/10/2021

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

ctparental_project:ctparental

Faiblesses (CWE)

CWE-352

References

https://gist.github.com/securylight/092ba96a660e07ad76f2a380c2eaa75a(cve@mitre.org)

https://gitlab.com/marsat/CTparental/(cve@mitre.org)

https://gist.github.com/securylight/092ba96a660e07ad76f2a380c2eaa75a(af854a3a-2127-422b-91ae-364da2661108)

https://gitlab.com/marsat/CTparental/(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.