CVE-2021-26215
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of a victim.
Risk Assessment
The risk involves unauthorized modification of documents, potentially leading to data integrity and authorization breaches in the document management system.
Recommendation
Immediately update SeedDMS to the latest version that fixes this vulnerability. Additionally, implement CSRF protection mechanisms such as anti-CSRF tokens.
Other vulnerabilities in SeedDMS
See all- CVE-2021-26216Medium
SeedDMS 5.1.x is affected by a cross-site request forgery (CSRF) vulnerability in out.EditFolder.php. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
- CVE-2020-28727Medium
A Cross-Site Scripting (XSS) vulnerability was discovered in SeedDMS 6.0.13 via the folderid parameter in views/bootstrap/class.DropFolderChooser.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.
Original NVD description (English source)
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS