Threat Investigation
Request a demo

CVE-2020-4040

High

Description

Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview. This has been fixed in Bolt 3.7.1

SeverityHigh
CVSS8.6
Exploit probability—
ProductBolt
PublishedJun 8, 2020
First seenJun 8, 2020
Weakness typeCWE-352Cross-site request forgery (CSRF)

How to fix

Update
  • boltcms bolt3.7.1 or later
  • bolt/bolt3.7.1 or later

Affected products

ProductAffected versionsFixed in
boltcms boltv < 3.7.13.7.1
bolt/boltPackagistv < 3.7.13.7.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.