CVE-2018-16314: CSRF
Published Sep 1, 2018
·Updated
An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header.
Affected Software
1 affected component
icmsdev icms=7.0.11
Event History
Sep 1, 2018
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2018-16314.
2
What is the severity of CVE-2018-16314?
CVE-2018-16314 has a severity score of 8.8, which is considered high.
3
What is the affected software?
The affected software is iCMS version 7.0.11 developed by icmsdev.
4
How can the vulnerability be exploited?
The vulnerability can be exploited by bypassing the CSRF_TOKEN verification in admincp.php.
5
Is there a fix available for CVE-2018-16314?
Currently, there is no known fix available for CVE-2018-16314. It is recommended to keep the software up to date and follow any security advisories from the vendor.