CVE-2020-25263: PyroCMS Vulnerable to CSRF
Summary
CVE-2020-25263: PyroCMS Vulnerable to CSRF. Affects pyrocms/pyrocms versions < 3.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyroCMS is an open-source content management system built on the Laravel framework. It provides a flexible and modular platform for creating and managing websites. PyroCMS version 3.7 is affected by a cross-site request forgery (CSRF) vulnerability. This vulnerability allows an attacker to perform unauthorized actions on behalf of a logged-in user by tricking them into visiting a malicious website or clicking on a specially crafted link.
Vulnerability Detail
The vulnerability in PyroCMS 3.7 exists in the admin/addons/uninstall/anomaly.module.blocks URI. By exploiting this vulnerability, an attacker can delete an arbitrary plugin, leading to potential data loss or disruption of the website's functionality. This vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to a fixed version of PyroCMS to mitigate the risk.
Conclusion
PyroCMS version 3.7 is vulnerable to a CSRF vulnerability that allows an attacker to delete arbitrary plugins. To mitigate this risk, users should update their PyroCMS installation to the latest version that includes the necessary security fixes. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyrocms/pyrocms →
FAQ
PyroCMS is an open-source content management system based on Laravel, providing a modular platform for website creation and management.
A CSRF vulnerability allows an attacker to perform unauthorized actions on behalf of a logged-in user by tricking them into visiting a malicious website or clicking on a specially crafted link.
The vulnerability allows an attacker to delete arbitrary plugins in PyroCMS, potentially leading to data loss or disruption of website functionality.
To fix this vulnerability, users should update their PyroCMS installation to the latest version that includes the necessary security fixes.
There is no known workaround for this vulnerability. It is crucial to apply the official patch or upgrade to a fixed version of PyroCMS.
Related vulnerabilities
Recent vulnerabilities recorded for pyrocms/pyrocms.
