Gleez CMS CSRF Allows Adding of Administrator Accounts
Summary
CVE-2018-15845: Gleez CMS CSRF Allows Adding of Administrator Accounts. Affects gleez/cms versions < 1.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gleez CMS is a content management system that allows users to create and manage websites. It is built on the Packagist ecosystem and is commonly used for website development. Gleez CMS version 1.2.0 is affected by a CSRF vulnerability that allows an attacker to add an administrator account via the 'admin/users/add' endpoint.
Vulnerability Detail
The CSRF vulnerability in Gleez CMS 1.2.0 allows an attacker to perform unauthorized actions on behalf of a user with administrative privileges. By exploiting this vulnerability, an attacker can add an administrator account without proper authentication or authorization. This can lead to complete compromise of the affected website, allowing the attacker to gain full control over its content and functionality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the official patch or upgrade to a non-affected version of Gleez CMS to ensure the security of the application.
Conclusion
The CSRF vulnerability in Gleez CMS 1.2.0 allows an attacker to add an administrator account without proper authentication or authorization. To mitigate this risk, it is crucial to upgrade to a non-affected version or apply the official patch. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gleez/cms →
FAQ
Gleez CMS is a content management system used for website development.
CSRF stands for Cross-Site Request Forgery. It is a type of attack where an attacker tricks a user into performing unwanted actions on a website without their consent or knowledge.
The CSRF vulnerability in Gleez CMS allows an attacker to add an administrator account, potentially leading to complete compromise of the affected website.
To fix this vulnerability, update Gleez CMS to a non-affected version or apply the official patch provided by the developers.
There are no known workarounds for this vulnerability. It is essential to update the CMS to a secure version.
Related vulnerabilities
Recent vulnerabilities recorded for gleez/cms.
