CVE-2025-25967

Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/padayali-JD/CVE-2025-25967	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ddsn:acora_cms:10.1.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-03 19:15

Updated : 2025-03-06 12:25

NVD link : CVE-2025-25967

Mitre link : CVE-2025-25967

CVE.ORG link : CVE-2025-25967

JSON object : View

Products Affected

ddsn

acora_cms

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-25967", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "published": "2025-03-03T19:15:35.400", "references": [{"url": "https://github.com/padayali-JD/CVE-2025-25967", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests."}, {"lang": "es", "value": "La versi\u00f3n 10.1.1 de Acora CMS es vulnerable a Cross-Site Request Forgery (CSRF). Esta falla permite a los atacantes enga\u00f1ar a los usuarios autenticados para que realicen acciones no autorizadas, como la eliminaci\u00f3n de cuentas o la creaci\u00f3n de usuarios, mediante la incorporaci\u00f3n de solicitudes maliciosas en contenido externo. La falta de protecci\u00f3n CSRF permite la explotaci\u00f3n mediante solicitudes manipuladas."}], "lastModified": "2025-03-06T12:25:50.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ddsn:acora_cms:10.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEA57E21-C43F-4273-A2B2-6DE0D9991F97"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}