CVE-2024-41597 - Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment

Back Back to CVE browser

LOW

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment

Published Jul 19, 2024

2.1

LOW

CVSS 4.0

EPSS 0.21%

Description

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situations in which CSRF would be a useful attack technique. Also, the submitted comments are, by default, held for moderator review.

Affected products

Vendor Processwire Product Processwire Default
n/a
- Version
  3.0.229
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Processwire

n/a

Version	Status	Constraints
3.0.229	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2411
Advisory
https://gist.github.com/DefensiumDevelopers/608be4d10b016dce0566925368a8b08c#file-cve-2024-41597-md
ExploitThird Party Advisory
https://github.com/advisories/GHSA-r9vw-cjf9-xh4x
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-41597

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2411		Advisory
https://gist.github.com/DefensiumDevelopers/608be4d10b016dce0566925368a8b08c#file-cve-2024-41597-md		ExploitThird Party Advisory
https://github.com/advisories/GHSA-r9vw-cjf9-xh4x		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-41597