CVE-2020-13155 NukeViet Cross-Site Request Forgery (CSRF)

What is CVE-2020-13155?

CVE-2020-13155 is a high-severity vulnerability in n/a, published on 23 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI.

Weakness: CWE-352

Which versions are affected by CVE-2020-13155?

2 open source packages ship an affected version, including nukeviet/nukeviet. It affects 1 product.

Products include Nukeviet Nukeviet.

How do I fix CVE-2020-13155?

No fix has been published for CVE-2020-13155 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-13155 being exploited?

There is no known exploitation of CVE-2020-13155 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2020-21808 NukeViet SQL Injection vulnerability via topicsid parameter Critical 9.8
• CVE-2020-21809 NukeViet SQL Injection vulnerability Critical 9.8
• CVE-2019-7725 Deserialization of Untrusted Data in NukeViet Critical 9.8
• CVE-2019-7726 SQL Injection in NukeViet Critical 9.8
• CVE-2020-13156 NukeViet Cross-Site Request Forgery (CSRF) Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7rw5-6pr4-fgh3.