CVE-2020-13868: Comments plugin Cross-Site Request Forgery (CSRF) in verbb/comments
Summary
CVE-2020-13868: Comments plugin Cross-Site Request Forgery (CSRF). Affects verbb/comments versions < 1.5.5. Fixed in 1.5.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Comments plugin is a package for Craft CMS that allows users to add comments to their website. It provides functionality for managing and displaying comments on web pages. The plugin is widely used and integrates with various versions of Craft CMS. However, it is vulnerable to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The CSRF vulnerability in the Comments plugin before version 1.5.5 for Craft CMS allows attackers to manipulate comment integrity. By exploiting this vulnerability, an attacker can trick authenticated users into performing unintended actions, such as posting comments or deleting existing comments without their knowledge or consent. This can lead to unauthorized modifications or deletions of comments, compromising the integrity of the comment system.
How To Fix
Minimum fixed version
1.5.5
This is the first release that contains the fix.
composer require verbb/comments:1.5.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the Comments plugin to the latest version.
Conclusion
The CSRF vulnerability in the Comments plugin for Craft CMS can compromise the integrity of the comment system, allowing unauthorized modifications or deletions of comments. It is crucial to update the plugin to version 1.5.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for verbb/comments →
FAQ
This vulnerability allows attackers to manipulate comment integrity, potentially leading to unauthorized modifications or deletions of comments.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this CSRF vulnerability in the Comments plugin.
Yes, upgrading to version 1.5.5 or later of the Comments plugin for Craft CMS fixes this vulnerability. It is recommended to update the plugin as soon as possible.
There are no known workarounds for this vulnerability. The recommended solution is to update the Comments plugin to the latest version.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-4r8c-pj7x-m5jx at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4r8c-pj7x-m5jx/GHSA-4r8c-pj7x-m5jx.json
References
Related vulnerabilities
Recent vulnerabilities recorded for verbb/comments.
