Skip to main content

Mccms CVE-2023-29815

HIGH
Cross-Site Request Forgery (CSRF) (CWE-352)
2023-04-28 cve@mitre.org
CSRF Mccms
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Apr 28, 2023 - 15:15 nvd
HIGH 8.8

DescriptionNVD

mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).

AnalysisAI

mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF). Affected products include: Chshcms Mccms.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.

More in Mccms

View all
CVE-2023-26781 CRITICAL POC
9.8 Apr 28

SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reade
CVE-2023-5029 HIGH POC
8.8 Sep 17

A vulnerability, which was classified as critical, was found in mccms 2.6. Rated high severity (CVSS 8.8), this vulnerab
CVE-2023-3236 HIGH POC
8.8 Jun 14

A vulnerability classified as critical has been found in mccms up to 2.6.5. Rated high severity (CVSS 8.8), this vulnera
CVE-2023-3235 HIGH POC
8.8 Jun 14

A vulnerability was found in mccms up to 2.6.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
CVE-2023-26782 MEDIUM POC
6.5 Apr 28

An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface
CVE-2025-51651 MEDIUM POC
5.5 Jul 14

A arbitrary file access vulnerability in the component /admin/Backups.php of Mccms (CVSS 5.5) that allows attackers. Ris
CVE-2025-51818 MEDIUM POC
5.4 Aug 21

MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. Rated medium severity (CVSS 5.4), thi
CVE-2025-50234 MEDIUM POC
6.5 Aug 06

MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where

CVE-2025-5328 MEDIUM POC
5.3 May 29

A vulnerability was found in chshcms mccms 2.7. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploit
CVE-2025-5327 MEDIUM POC
5.3 May 29

A vulnerability was found in chshcms mccms 2.7. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploit

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2023-29815 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy