CVE-2020-37007

EUVD-2020-30902
Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate user account settings without proper request validation. Attackers can craft malicious HTML forms to change user passwords or modify account information by tricking logged-in users into submitting unauthorized requests.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
VulnCheckCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 2%
Affected Products (NVD)
VendorProductVersion
salihciftciliman
0.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://web.archive.org/web/20201109042653/https://github.com/salihciftci/liman
https://www.exploit-db.com/exploits/48869
https://www.vulncheck.com/advisories/liman-cross-site-request-forgery-change-password
https://www.exploit-db.com/exploits/48869