CVE-2023-49447: CSRF
First published: Tue Dec 05 2023(Updated: )
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/com.jfinal:jfinal | <=5.0.0 | |
| JFinalCMS | =5.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-49447?
The severity of CVE-2023-49447 is classified as high, with a severity value of 8.8.
How does JFinalCMS v5.0.0 contain a Cross-Site Request Forgery (CSRF) vulnerability?
JFinalCMS v5.0.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the /admin/nav/update location, which allows attackers to perform unauthorized actions on behalf of users.
How can I mitigate the Cross-Site Request Forgery (CSRF) vulnerability in JFinalCMS v5.0.0?
To mitigate the CSRF vulnerability in JFinalCMS v5.0.0, it is recommended to implement and validate CSRF tokens for all privileged actions, including the /admin/nav/update endpoint.
Is there any available patch or update for JFinalCMS v5.0.0 to fix CVE-2023-49447?
It is recommended to check the official JFinalCMS project repository for any available patches or updates to fix the CVE-2023-49447 vulnerability.
What is the Common Weakness Enumeration (CWE) ID associated with CVE-2023-49447?
The Common Weakness Enumeration (CWE) ID associated with CVE-2023-49447 is CWE-352 (Cross-Site Request Forgery).
- collector/github-advisory-latest
- alias/GHSA-32j2-c7mx-v4jj
- alias/CVE-2023-49447
- collector/github-advisory
- agent/type
- agent/author
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/maven
- vendor/jfinalcms project
- canonical/jfinalcms
- version/jfinalcms/5.0.0