CVE-2021-25976: Cross-Site Request Forgery (CSRF)

November 16, 2021 (updated November 17, 2021)

PiranhaCMS is vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.

References

github.com/PiranhaCMS/piranha.core/commit/e42abacdd0dd880ce9cf6607efcc24646ac82eda
nvd.nist.gov/vuln/detail/CVE-2021-25976
www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25976

Code Behaviors & Features

Detect and mitigate CVE-2021-25976 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →