CVE-2018-1000137

I, Librarian version 4.8 and earlier contains a Cross site Request Forgery (CSRF) vulnerability in users.php that can result in the password of the admin being forced to be changed without the administrator's knowledge.

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.57% chance of exploitation in the next 30 days, 46th percentile

Published

2018-03-23

Updated

2024-09-16

Proof-of-concept exploits (1)

• mkucej/i-librarian/issues/12199★ · 2022-11-13

References

• CVE Record
• NVD entry

Related

• CVE-2018-1000124
• CVE-2018-1000138
• CVE-2018-1000139
• CVE-2019-11359
• CVE-2019-11428
• CVE-2022-47854