CVE-2018-11680

MEDIUM

CmsEasy 6.1_20180508 - Cross-Site Request Forgery via Rich Text Editor IFRAME Injection

Title source: llm
STIX 2.1

Description

An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability in the rich text editor that can add an IFRAME element. This might be used in a DoS attack if a referenced remote URL is refreshed at a rapid rate.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
http://www.8sec.cc/archives/619

Scores

CVSS v3 6.5
EPSS 0.0042
EPSS Percentile 33.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE
CWE-352
Status published
Products (1)
cmseasy/cmseasy 6.0 20180508
Published Jun 02, 2018
Tracked Since Feb 18, 2026