Vulnerability Description
SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change.
CVSS Score
8.8
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Syguestbook A5 Project | Syguestbook A5 | 1.2 |
Related Weaknesses (CWE)
References
- https://fragrant10.github.io/2019/02/22/SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1ExploitThird Party Advisory
- https://github.com/fragrant10/fragrant10.github.io/blob/master/_posts/2019-02-22ExploitThird Party Advisory
- https://fragrant10.github.io/2019/02/22/SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1ExploitThird Party Advisory
- https://github.com/fragrant10/fragrant10.github.io/blob/master/_posts/2019-02-22ExploitThird Party Advisory
FAQ
What is CVE-2019-13949?
CVE-2019-13949 is a vulnerability with a CVSS score of 8.8 (HIGH). SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change.
How severe is CVE-2019-13949?
CVE-2019-13949 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-13949?
Check the references section above for vendor advisories and patch information. Affected products include: Syguestbook A5 Project Syguestbook A5.