CVE-2018-1000846 describes a Cross-Site Request Forgery (CSRF) vulnerability in FreshDNS versions 1.0.3 and earlier, specifically impacting authenticated API calls within index.php and class.manager.php. This flaw allows an attacker to manipulate a victim's FreshDNS domains and zones with their privileges if the victim visits a malicious website containing attacker-controlled JavaScript. The vulnerability carries a high CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating it can be exploited remotely with low attack complexity, requiring user interaction, and potentially leading to high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion, and it is not listed on the CISA KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.0.3CPE matchmatch criteria | cpe:2.3:a:freshdns_project:freshdns:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.