CVE-2023-49446

Summary

CVE-2023-49446 is a Cross-Site Request Forgery (CSRF) vulnerability affecting JFinalCMS version 5.0.0. An attacker can exploit this issue by making unauthorized changes to the administration settings through the /admin/nav/save endpoint. The flaw occurs due to insufficient input validation, allowing malicious requests to be processed by the server on behalf of the victim. This vulnerability poses a significant risk to organizations using JFinalCMS, and it is recommended that users immediately upgrade to a patched version to mitigate the threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.