CVE-2021-25976: Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF)
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25976?
CVE-2021-25976 is classified as a medium severity vulnerability due to its impact on the integrity of user management actions in PiranhaCMS.
How do I fix CVE-2021-25976?
To fix CVE-2021-25976, upgrade to PiranhaCMS version 10.0.0 or later, which addresses the CSRF vulnerability.
What types of actions are affected by CVE-2021-25976?
CVE-2021-25976 affects actions such as deleting a user, deleting a role, editing a post, and deleting a media folder if an ID is known.
Which versions of PiranhaCMS are vulnerable to CVE-2021-25976?
PiranhaCMS versions 4.0.0-alpha1 to 9.2.0 are vulnerable to CVE-2021-25976.
What is the nature of the vulnerability in CVE-2021-25976?
CVE-2021-25976 is a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of legitimate users.