CVE-2017-9444

HIGH

BigTree CMS <= 4.2.18 - Cross-Site Request Forgery in User Profile and Developer Endpoints

Title source: llm
STIX 2.1

Description

BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the index.php/admin/developer/upgrade/set-ftp-directory/ URI.

References (1)

Core 1
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/bigtreecms/BigTree-CMS/issues/293

Scores

CVSS v3 8.8
EPSS 0.0045
EPSS Percentile 36.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
bigtreecms/bigtree_cms < 4.2.18
Published Jun 05, 2017
Tracked Since Feb 18, 2026