CVE-2020-4040

Published June 8th, 2020

View on NVD ↗

CVSS v3

8.6

HIGH

CVSS v2

4.3

MEDIUM

Affected

PROJECT

Description

Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview. This has been fixed in Bolt 3.7.1

bolt/bolt

Bolt is a simple CMS written in PHP. It is based on Silex and Symfony components, uses Twig and either SQLite, MySQL or PostgreSQL.

GitHub

4.14K