Vulnerability Description
MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to force administrators to create and save site bundles containing sensitive data to publicly accessible directories. This vulnerability enables complete data exfiltration including user accounts, password hashes, form submissions, email lists, plugins, and site content without administrator knowledge. This CSRF vulnerability enables complete data exfiltration from MuraCMS installations without requiring authentication. Attackers can force administrators to unknowingly create site bundles containing sensitive data, which are saved to publicly accessible web directories. The attack executes silently, leaving administrators unaware that confidential information has been compromised and is available for unauthorized download.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Murasoftware | Mura Cms | - |
Related Weaknesses (CWE)
References
- https://docs.murasoftware.com/v10/release-notes/#section-version-1014Release Notes
- https://www.murasoftware.comProduct
FAQ
What is CVE-2025-55043?
CVE-2025-55043 is a vulnerability with a CVSS score of 6.5 (MEDIUM). MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to force administrators to create a...
How severe is CVE-2025-55043?
CVE-2025-55043 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-55043?
Check the references section above for vendor advisories and patch information. Affected products include: Murasoftware Mura Cms.