- Description
- Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- emlog
CVSS 3.1
- Type
- Primary
- Base score
- 7.3
- Impact score
- 5.2
- Exploitability score
- 2.1
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
- Severity
- HIGH
- security-advisories@github.com
- CWE-352
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:*",
"matchCriteriaId": "79AE61F7-870D-42A7-A8A4-8DA998EF3860",
"versionEndIncluding": "2.6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]