What is GHSA-3g6c-88pf-m46f?

GHSA-3g6c-88pf-m46f is a security advisory published by GitHub Security Advisories with High severity. Bolt Cross Site Request Forgery (CSRF)

Which CVE IDs does GHSA-3g6c-88pf-m46f cover?

GHSA-3g6c-88pf-m46f covers the following CVE IDs: CVE-2019-10874. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3g6c-88pf-m46f?

GHSA-3g6c-88pf-m46f has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-3g6c-88pf-m46f?

GHSA-3g6c-88pf-m46f affects 1 product, including: composer/bolt/bolt:= 3.6.6.

GHSA-3g6c-88pf-m46fHighCVSS 8.8

Bolt Cross Site Request Forgery (CSRF)

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

April 23, 2024

🔗 CVE IDs covered (1)

CVE-2019-10874 →

📋 Description

Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.

🎯 Affected products1

composer/bolt/bolt:= 3.6.6

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-10874
https://github.com/bolt/bolt/pull/7768/commits/91187aef36363a870d60b0a3c1bf8507af34c9e4
http://packetstormsecurity.com/files/152429/Bolt-CMS-3.6.6-Cross-Site-Request-Forgery-Code-Execution.html
https://fgsec.net/from-csrf-to-rce-bolt-cms
https://www.exploit-db.com/exploits/46664
https://github.com/advisories/GHSA-3g6c-88pf-m46f