CVE-2025-25967

Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/padayali-JD/CVE-2025-25967	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ddsn:acora_cms:10.1.1:*:*:*:*:*:*:*

History

06 Mar 2025, 12:21

Type	Values Removed	Values Added
CPE		cpe:2.3:a:ddsn:acora_cms:10.1.1:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~6.8~~	v2 : unknown v3 : 8.8
First Time		Ddsn Ddsn acora Cms
References	~~() https://github.com/padayali-JD/CVE-2025-25967 -~~	() https://github.com/padayali-JD/CVE-2025-25967 - Third Party Advisory
Summary		(es) La versión 10.1.1 de Acora CMS es vulnerable a Cross-Site Request Forgery (CSRF). Esta falla permite a los atacantes engañar a los usuarios autenticados para que realicen acciones no autorizadas, como la eliminación de cuentas o la creación de usuarios, mediante la incorporación de solicitudes maliciosas en contenido externo. La falta de protección CSRF permite la explotación mediante solicitudes manipuladas.

04 Mar 2025, 17:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.8
CWE		CWE-352

03 Mar 2025, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-03 19:15

Updated : 2025-03-06 12:21

NVD link : CVE-2025-25967

Mitre link : CVE-2025-25967

CVE.ORG link : CVE-2025-25967

JSON object : View

Products Affected

ddsn

acora_cms

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-25967", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "published": "2025-03-03T19:15:35.400", "references": [{"url": "https://github.com/padayali-JD/CVE-2025-25967", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests."}, {"lang": "es", "value": "La versi\u00f3n 10.1.1 de Acora CMS es vulnerable a Cross-Site Request Forgery (CSRF). Esta falla permite a los atacantes enga\u00f1ar a los usuarios autenticados para que realicen acciones no autorizadas, como la eliminaci\u00f3n de cuentas o la creaci\u00f3n de usuarios, mediante la incorporaci\u00f3n de solicitudes maliciosas en contenido externo. La falta de protecci\u00f3n CSRF permite la explotaci\u00f3n mediante solicitudes manipuladas."}], "lastModified": "2025-03-06T12:21:35.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ddsn:acora_cms:10.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEA57E21-C43F-4273-A2B2-6DE0D9991F97"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}