ProcessWire Cross Site Request Forgery vulnerability

MEDIUM 4.2CVE-2024-41597 · GHSA-r9vw-cjf9-xh4x · Published 19/07/2024 · updated 09/07/2026

Package	Affected versions	Patched versions
processwire/processwire Packagist	`≤ 3.0.229`	No fix yet
processwire processwire	`= 3.0.229`	No fix yet

Description

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality.

NVD description

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situations in which CSRF would be a useful attack technique. Also, the submitted comments are, by default, held for moderator review.

References

nvd.nist.gov/vuln/detail/CVE-2024-41597 · ADVISORY
gist.github.com/DefensiumDevelopers/608be4d10b016dce0566925368a8b08c · WEB
processwire/processwire · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free