CVE-2024-2235

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 74.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Himer2code Himer
Timeline
PublishedJul 3

Description

The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVD2code/himer< 2.1.1
▶CVEListV5unknown/himer< 2.1.1

🔴Vulnerability Details

2
CVEList
Himer - Social Questions and Answers < 2.1.1 - Bypass Poll Voting Restrictions via CSRF↗2024-07-03
▶
GHSA
GHSA-5q6f-fphm-w5qc: The Himer WordPress theme before 2↗2024-07-03
▶