CVE-2017-8081

Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2017-04-30

Last modified

2024-08-05

Weaknesses

CWE-338

Affected products

• Getsimple Cms (Cagintranetworks)

References

• https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1224