要点
- CVE-2024-41597 是影响 processwire/processwire, processwire (processwire) 的中危 (CVSS 4.2)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.21%，高于 11.5% 的漏洞。
- 暂无已修复版本：请关注参考资料中的厂商公告。
Description
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality.
NVD description
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situations in which CSRF would be a useful attack technique. Also, the submitted comments are, by default, held for moderator review.
processwire/processwire 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free