CVE-2020-37241: bloofoxCMS 0.5.2.1 Cross-Site Request Forgery via user add
bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious pages. Attackers can craft hidden forms targeting the admin user creation endpoint to add new administrative accounts with arbitrary credentials without requiring explicit user consent.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37241?
CVE-2020-37241 is classified as a medium-severity vulnerability due to its potential for enabling unauthorized administrative actions.
How do I fix CVE-2020-37241?
To mitigate CVE-2020-37241, implement CSRF tokens for sensitive actions and ensure user permissions are strictly enforced.
Who is affected by CVE-2020-37241?
CVE-2020-37241 specifically affects users of bloofoxCMS version 0.5.2.1.
What type of vulnerability is CVE-2020-37241?
CVE-2020-37241 is a Cross-Site Request Forgery (CSRF) vulnerability.
Can CVE-2020-37241 be exploited remotely?
Yes, CVE-2020-37241 can be exploited remotely by tricking logged-in users into visiting malicious pages.