CVE-2023-49397

Summary

CVE-2023-49397 is a newly disclosed Cross-Site Request Forgery (CSRF) vulnerability affecting JFinalCMS version 5.0.0. An attacker can exploit this issue by manipulating a user into visiting a malicious website, which then initiates unintended actions in the administrator panel of the affected CMS. Specifically, the vulnerability can be found within the /admin/category/updateStatus endpoint. Successful exploitation could result in unauthorized modifications to the victim's CMS categories. Users are strongly encouraged to upgrade to a patched version of JFinalCMS to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.