CVE-2022-4564 University of Central Florida Materia API Controller api.php before cross-site request forgery
Attackers can perform unauthorized actions on behalf of authenticated users via CSRF in the Materia API Controller.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-4564?
CVE-2022-4564 is a medium-severity vulnerability in University of Central Florida Materia, published on 16 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fuel/app/classes/controller/api.php of the component API Controller. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 9.0.1-alpha1 is able to address this issue. The name of the patch is af259115d2e8f17068e61902151ee8a9dbac397b. It is recommended to upgrade the affected component. The identifier VDB-215973 was assigned to this vulnerability.
Weakness: CWE-352
Which versions are affected by CVE-2022-4564?
It affects 1 product.
Products include Ucf Materia.
How do I fix CVE-2022-4564?
No fix has been published for CVE-2022-4564 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-4564 being exploited?
There is no known exploitation of CVE-2022-4564 in the wild and no public exploit code.
Sources
Also known as GHSA-hhgp-gprq-pm7x.