GHSA-6xw3-cpqj-8mxr

ThinkCMF Cross Site Request Forgery (CSRF) vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2022-40489

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	thinkcmf/thinkcmf	< 6.0.8	6.0.8

Details

As written in the advisory (Markdown source, shown as plain text).

ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-40489 advisory
https://github.com/thinkcmf/thinkcmf/issues/736 web
https://github.com/thinkcmf/thinkcmf/commit/321faa20865e74540e5f0a63e4c3f4ea75093d59 web
https://github.com/thinkcmf/thinkcmf/commit/b61636134aa57d4693967f35772200c779099740 web
https://github.com/thinkcmf/thinkcmf package