Vulnerability Description
FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This attack appear to be exploitable via Victim must open a website containing attacker's javascript. This vulnerability appears to have been fixed in 1.0.5 and later.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Freshdns Project | Freshdns | <= 1.0.3 |
Related Weaknesses (CWE)
References
- https://github.com/funzoneq/freshdns/issues/7Third Party Advisory
- https://github.com/funzoneq/freshdns/pull/6/commits/bdeff81bd4baff9463d46b90fb18PatchThird Party Advisory
- https://github.com/funzoneq/freshdns/issues/7Third Party Advisory
- https://github.com/funzoneq/freshdns/pull/6/commits/bdeff81bd4baff9463d46b90fb18PatchThird Party Advisory
FAQ
What is CVE-2018-1000846?
CVE-2018-1000846 is a vulnerability with a CVSS score of 8.8 (HIGH). FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API calls in index.php / class.manager.php that can result in Editing domains and zo...
How severe is CVE-2018-1000846?
CVE-2018-1000846 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-1000846?
Check the references section above for vendor advisories and patch information. Affected products include: Freshdns Project Freshdns.