Skip to main content

Cm Download Manager CVE-2024-1231

MEDIUM
Cross-Site Request Forgery (CSRF) (CWE-352)
2024-03-25 contact@wpscan.com
WordPress CSRF Cm Download Manager
6.8
CVSS 3.1 · Vendor: wpscan
Share

Severity by source

Vendor (wpscan) PRIMARY
6.8 MEDIUM
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Primary rating from Vendor (wpscan) · only source for this CVE.

CVSS VectorVendor: wpscan

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

1
CVE Published
Mar 25, 2024 - 05:15 cve.org
MEDIUM 6.8

DescriptionCVE.org

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack

AnalysisAI

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack Affected products include: Cminds Cm Download Manager. Version information: before 2.9.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.

More in Cm Download Manager

View all
CVE-2014-8877 CRITICAL POC
10.0 Dec 05

The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plug
CVE-2024-1962 HIGH POC
8.8 Mar 25

The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attack
CVE-2022-3076 HIGH POC
7.2 Sep 26

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary file
CVE-2014-9129 MEDIUM POC
6.8 Dec 05

Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPr
CVE-2020-27344 MEDIUM POC
6.1 Oct 21

The cm-download-manager plugin before 2.8.0 for WordPress allows XSS. Rated medium severity (CVSS 6.1), this vulnerabili
CVE-2024-1232 MEDIUM POC
4.8 Mar 25

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attack

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2024-1231 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy