CVE-2021-37366

CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick the administrator into clicking a link that cancels the filtering for all standard users.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2021-08-10

Last modified

2024-08-04

Weaknesses

CWE-352

Affected products

• Ctparental (Ctparental Project)

References

• https://gist.github.com/securylight/092ba96a660e07ad76f2a380c2eaa75a
• https://gitlab.com/marsat/CTparental/