CVE-2021-44942 Cross-site request forgery in n/a
An attacker can trick an administrator into adding entries to the blacklist via a Cross-Site Request Forgery vulnerability in the bad_behavior2 plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-44942?
CVE-2021-44942 is a medium-severity vulnerability in n/a, published on 14 Dec 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in /public_html/admin/plugins/bad_behavior2/blacklist.php. Using the CSRF vulnerability to trick the administrator to click, an attacker can add a blacklist.
Weakness: CWE-352
Which versions are affected by CVE-2021-44942?
It affects 1 product.
Products include Glfusion Glfusion.
How do I fix CVE-2021-44942?
No fix has been published for CVE-2021-44942 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-44942 being exploited?
There is no known exploitation of CVE-2021-44942 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as CVE-2021-44948, GHSA-6xx3-7c4w-v79g.