CVE-2018-19291 Cross-site request forgery in n/a

Medium 6.5 Published 15 Nov 2018 Updated 5 Aug 2024

Cross-site request forgery in DiliCMS allows attackers to delete users or groups by tricking admins into visiting malicious links.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2018-19291?

CVE-2018-19291 is a medium-severity vulnerability in n/a, published on 15 Nov 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI.

Weakness: CWE-352

Which versions are affected by CVE-2018-19291?

It affects 1 product.

Products include Dilicms Dilicms.

How do I fix CVE-2018-19291?

No fix has been published for CVE-2018-19291 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-19291 being exploited?

There is no known exploitation of CVE-2018-19291 in the wild and no public exploit code.

Sources

Also known as GHSA-h7jm-ppvf-4m5h.