CVE-2023-49373 describes a Cross-Site Request Forgery (CSRF) vulnerability in JFinalCMS v5.0.0, specifically impacting the /admin/slide/delete endpoint. This high-severity vulnerability (CVSS 8.8) allows an unauthenticated attacker to trick an authenticated user into performing unintended actions, such as deleting slides, with high impact on confidentiality, integrity, and availability. While no public exploits, Metasploit modules, or Nuclei templates are currently available, and there is minimal community discussion or media coverage, the ease of exploitation due to low attack complexity warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.0.0CPE matchmatch criteria | cpe:2.3:a:jfinalcms_project:jfinalcms:5.0.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.