CVE-2020-13458: Image Resizer Cross-Site Request Forgery (CSRF)
Summary
CVE-2020-13458: Image Resizer Cross-Site Request Forgery (CSRF). Affects verbb/image-resizer versions < 2.0.9. Fixed in 2.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Image Resizer plugin is a component of Craft CMS that allows users to resize images. It is commonly used to optimize images for web display. The plugin provides various features and functionalities for image manipulation, including resizing, cropping, and compression. However, a vulnerability has been discovered in versions prior to 2.0.9 that exposes the plugin to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The CSRF vulnerability in the Image Resizer plugin allows an attacker to trick authenticated users into performing unintended actions without their consent. By exploiting this vulnerability, an attacker can perform actions on behalf of the victim, such as clearing the log files. This can lead to unauthorized access, data loss, or other malicious activities. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.0.9
This is the first release that contains the fix.
composer require verbb/image-resizer:2.0.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is essential to update the plugin to the latest version to mitigate the CSRF risk effectively.
Conclusion
The Image Resizer plugin for Craft CMS is vulnerable to Cross-Site Request Forgery (CSRF) attacks. To protect your system, it is crucial to update the plugin to version 2.0.9 or later. This update includes security patches that address the CSRF vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for verbb/image-resizer →
FAQ
The Image Resizer plugin is a component of Craft CMS that allows users to resize images for web display.
Cross-Site Request Forgery (CSRF) is an attack that tricks authenticated users into performing unintended actions without their consent.
This vulnerability can lead to unauthorized access, data loss, or other malicious activities performed by an attacker on behalf of the victim.
To fix this vulnerability, update the Image Resizer plugin to version 2.0.9 or later.
No, it is necessary to update the plugin to the latest version to mitigate the CSRF risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for verbb/image-resizer.
