CVE-2020-24130

HIGH

Ponzu 0.11.0 - Cross-Site Request Forgery in Configure Component

Title source: llm
STIX 2.1

Description

A cross site request forgery (CSRF) vulnerability in the configure.html component of Ponzu 0.11.0 allows attackers to change user and administrator credentials, and add or delete administrator accounts.

References (1)

Core 1
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/ponzu-cms/ponzu/issues/352

Scores

CVSS v3 8.1
EPSS 0.0043
EPSS Percentile 34.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
ponzu-cms/ponzu 0.11.0
Published Aug 20, 2021
Tracked Since Feb 18, 2026