medium4.3
CVE-2020-36389
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.
Impact
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Civicrm | Civicrm | before 5.27.5 before 5.28.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/
- https://civicrm.org/advisory/civi-sa-2020-11-csrf-ckeditor-configuration-form
- https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/
- https://civicrm.org/advisory/civi-sa-2020-11-csrf-ckeditor-configuration-form