EUVD-2025-208831Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to force administrators to create and save site bundles containing sensitive data to publicly accessible directories. This vulnerability enables complete data exfiltration including user accounts, password hashes, form submissions, email lists, plugins, and site content without administrator knowledge. This CSRF vulnerability enables complete data exfiltration from MuraCMS installations without requiring authentication. Attackers can force administrators to unknowingly create site bundles containing sensitive data, which are saved to publicly accessible web directories. The attack executes silently, leaving administrators unaware that confidential information has been compromised and is available for unauthorized download.
AnalysisAI
MuraCMS through version 10.1.10 contains a Cross-Site Request Forgery (CSRF) vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to force administrators into unknowingly creating and exporting site bundles containing complete sensitive data to publicly accessible web directories. Affected administrators have no knowledge the attack occurred, enabling complete data exfiltration including user accounts, password hashes, form submissions, email lists, plugins, and site content. While no CVSS score or EPSS probability is available and KEV status is unknown, the vulnerability's silent nature combined with its ability to compromise all site data without authentication represents a critical confidentiality and integrity risk.
Technical ContextAI
This vulnerability exploits the lack of CSRF token validation in MuraCMS's bundle export functionality, specifically the createBundle method within the csettings.cfc ColdFusion component. MuraCMS is a content management system built on ColdFusion/CFML, and the vulnerability exists in versions through 10.1.10 as indicated by the release notes reference (version 10.1.4 mentioned in documentation suggests patches may exist in later versions). The root cause is CWE-352 (Cross-Site Request Forgery - CSRF), where administrative actions that export sensitive data lack proper origin validation, state tokens, or request authentication. When an administrator visits a malicious webpage while maintaining an active MuraCMS session, attacker-controlled JavaScript can trigger the bundle creation endpoint without the administrator's knowledge, causing the CMS to serialize and export all site data to the web-accessible directory where MuraCMS stores exported bundles.
RemediationAI
Upgrade MuraCMS to a patched version immediately (refer to vendor release notes at https://docs.murasoftware.com/v10/release-notes/ for the first patched version after 10.1.10). As an interim mitigation before patching is possible, implement CSRF token validation at the web application firewall or reverse proxy level by enforcing that bundle export requests originate from same-origin contexts only (validate Origin and Referer headers), restrict direct web access to bundle export directories using .htaccess or web server configuration to allow only authenticated users, enforce secure session management with SameSite=Strict cookie flags, and educate administrators to immediately review exported bundles in their web-accessible directories for unauthorized exports. Additionally, implement network segmentation to restrict admin access to MuraCMS from specific IP ranges and consider disabling bundle export functionality via ColdFusion component protection until patching completes.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today