CVE-2017-8081

HIGH

GetSimple CMS 3.3.13 - Privilege Escalation and CSRF via Weak PRNG in Session Cookie

Title source: llm

Description

Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce.

References (1)

Core 1

Core References

Issue Tracking, Vendor Advisory x_refsource_confirm

https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1224

Scores

CVSS v3 8.8

EPSS 0.0126

EPSS Percentile 65.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-338

Status published

Products (1)

cagintranetworks/getsimple_cms 3.3.13_

Published Apr 30, 2017

Tracked Since Feb 18, 2026