CVE-2024-1962

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
8.8HIGH
EPSS
0.8%
top 26.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown CM Download ManagerCminds CM Download Manager
Timeline
PublishedMar 25

Description

The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5unknown/cm_download_manager< 2.9.1

🔴Vulnerability Details

2
CVEList
CM Download and File Manager < 2.9.1 - Download Edit via CSRF↗2024-03-25
▶
GHSA
GHSA-6fc3-8g79-3f39: The CM Download Manager WordPress plugin before 2↗2024-03-25
▶
CVE-2024-1962 (HIGH CVSS 8.8) | The CM Download Manager WordPress p | cvebase.io