Skip to main content

Textpattern CVE-2020-29458

HIGH
Cross-Site Request Forgery (CSRF) (CWE-352)
2020-12-02 cve@mitre.org
CSRF Textpattern
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 02, 2020 - 09:15 nvd
HIGH 8.8

DescriptionNVD

Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.

AnalysisAI

Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Affected products include: Textpattern.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.

More in Textpattern

View all
CVE-2018-7474 CRITICAL POC
9.8 Mar 14

An issue was discovered in Textpattern CMS 4.6.2 and earlier. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2023-50038 HIGH POC
8.8 Dec 28

There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of

CVE-2023-24269 HIGH POC
8.8 Apr 28

An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute a
CVE-2021-47943 HIGH POC
8.7 May 10

TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbi
CVE-2021-47976 HIGH POC
8.7 May 16

TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload a
CVE-2018-1000090 HIGH POC
7.5 Mar 13

textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial
CVE-2023-36220 HIGH POC
7.2 Aug 07

Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary

CVE-2023-26852 HIGH POC
7.2 Apr 12

An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute

CVE-2021-30209 MEDIUM POC
6.5 Apr 15

Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background witho
CVE-2021-28002 MEDIUM POC
5.4 Aug 19

A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which a
CVE-2021-28001 MEDIUM POC
5.4 Aug 19

A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remo
CVE-2026-32986 MEDIUM POC
5.1 Mar 20

A second-order XSS vulnerability exists in Textpattern CMS version 4.9.0 where user-supplied input (such as category par

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2020-29458 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy