HIGH8.8

GHSA-3p9v-xp6w-wcmc

QuickAppsCMS Cross-Site Request Forgery (CSRF)

Details

An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/quickapps/cms

Introduced in: 0

No fixed version published yet for quickapps/cms (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-17102[ADVISORY]
https://github.com/quickapps/cms/issues/187[WEB]
https://github.com/quickapps/cms/issues/199[WEB]
https://github.com/quickapps/cms[PACKAGE]