CVE-2018-18921: CSRF in PHP Server Monitor before 3.3.2
Summary
CVE-2018-18921: CSRF in PHP Server Monitor before 3.3.2. Affects phpservermon/phpservermon versions < 3.3.2. Fixed in 3.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP Server Monitor is a monitoring tool written in PHP that allows users to monitor the status of various servers and services. It provides a web interface to view the status of servers, track uptime, and receive notifications in case of failures. However, versions before 3.3.2 are vulnerable to a Cross-Site Request Forgery (CSRF) attack.
Vulnerability Detail
The CSRF vulnerability in PHP Server Monitor allows an attacker to perform unauthorized actions on behalf of a victim user. By tricking the victim into visiting a specially crafted website or clicking on a malicious link, the attacker can execute actions such as deleting data or modifying settings in PHP Server Monitor. This vulnerability can lead to data loss, service disruption, or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
3.3.2
This is the first release that contains the fix.
composer require phpservermon/phpservermon:3.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
PHP Server Monitor before version 3.3.2 is vulnerable to a CSRF attack, which can lead to unauthorized actions and potential security risks. It is crucial to upgrade to version 3.3.2 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpservermon/phpservermon →
FAQ
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into performing unwanted actions on a web application in which they are authenticated.
This vulnerability allows an attacker to perform unauthorized actions on behalf of a victim user in PHP Server Monitor, potentially leading to data loss or unauthorized access.
The impact of this vulnerability can range from data loss and service disruption to unauthorized access to sensitive information.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade to the latest version of PHP Server Monitor.
To upgrade PHP Server Monitor, follow the instructions provided by the official documentation or the project maintainers.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpservermon/phpservermon.
