CVE-2024-35475: CSRF
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35475?
CVE-2024-35475 is considered a medium severity vulnerability due to its potential to allow unauthorized execution of SQL commands.
How do I fix CVE-2024-35475?
To fix CVE-2024-35475, upgrade to OpenKM Community Edition version 6.3.13 or later, where the vulnerability has been addressed.
Who is affected by CVE-2024-35475?
CVE-2024-35475 affects users of OpenKM Community Edition versions prior to 6.3.13 with administrative privileges.
What kind of attack does CVE-2024-35475 enable?
CVE-2024-35475 enables a Cross-Site Request Forgery (CSRF) attack that can manipulate users into executing arbitrary SQL commands.
What components of OpenKM are impacted by CVE-2024-35475?
CVE-2024-35475 impacts the /admin/DatabaseQuery component of OpenKM Community Edition.