V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS

V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS

GitHubGitHub
GitHubgithub.com
Releases1
Frequency
Last Release
Stars7
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2021-45268↗
8.8 HIGH6.8 MEDIUM

A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cookie of a high-privileged authenticated user who is entitled to install arbitrary add-ons