CVE-2024-9281

bg5sbk MiniCMS post-edit.php cross-site request forgery

Medium6.9EPSS 0.36%

Published: 27 Sept 2024
Updated: 27 Sept 2024
Reserved: 27 Sept 2024
Assigned by: VulDB

Description

A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic. This issue affects some unknown processing of the file post-edit.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions confusing version and file name information. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS scores of CVE-2024-9281, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
VulDBCNA (assigner)	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
VulDBCNA (assigner)	3.0	Medium4.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
VulDBCNA (assigner)	2.0	Medium5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N
NVDNVD · Analyzed	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.36% · top 71% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

CWE-352: Cross-Site Request Forgery (opens in a new tab)All about CWE-352 and its CVEs

Affected products

bg5sbk · MiniCMS
- affected 1.0
- affected 1.1
- affected 1.2
- affected 1.3
- affected 1.4
- affected 1.5
- affected 1.6
- affected 1.7
- affected 1.8
- affected 1.9
- affected 1.10
- affected 1.11

References (4)

VDB-278663 | bg5sbk MiniCMS post-edit.php cross-site request forgery (opens in a new tab)vdb-entry
VDB-278663 | CTI Indicators (IOB, IOC, IOA) (opens in a new tab)signaturepermissions-required
Submit #411164 | bg5sbk MiniCMS v1.11 Cross-Site Request Forgery (opens in a new tab)third-party-advisory
https://github.com/bg5sbk/MiniCMS/issues/51 (opens in a new tab)exploitissue-tracking

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2024-9281](https://trackcve.app/badge/CVE-2024-9281.svg)](https://trackcve.app/cve/CVE-2024-9281)

Record last updated 27 Sept 2024, 14:23 UTC.