CVE-2018-19291

An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI.

CVSS v3.0

6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0

5.8 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P

EPSS

0.65% chance of exploitation in the next 30 days, 49th percentile

Published

2018-11-15

Updated

2024-08-05

Proof-of-concept exploits (1)

• chekun/DiliCMS/issues/60

References

• CVE Record
• NVD entry

Related

• CVE-2018-18209
• CVE-2018-18210
• CVE-2018-19290
• CVE-2018-19300
• CVE-2018-19289
• CVE-2018-1932