CVE-2020-35943

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
6.5MEDIUM
EPSS
0.1%
top 70.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Imagely Nextgen Gallery
Timeline
PublishedFeb 9
Latest updateMay 24

Description

A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-6fjc-q4q2-mv97: A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3↗2022-05-24
▶
CVEList
CVE-2020-35943: A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3↗2021-02-09
▶
CVE-2020-35943 (MEDIUM CVSS 6.5) | A Cross-Site Request Forgery (CSRF) | cvebase.io