CVE-2021-26216
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
SeedDMS 5.1.x is affected by a cross-site request forgery (CSRF) vulnerability in out.EditFolder.php. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
Risk Assessment
The risk involves potential unauthorized modification or deletion of folders in SeedDMS, leading to data integrity loss without the administrator's knowledge.
Recommendation
Immediately update SeedDMS to the latest patched version and implement CSRF protection mechanisms such as anti-CSRF tokens.
Other vulnerabilities in SeedDMS
See all- CVE-2021-26215Medium
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of a victim.
- CVE-2020-28727Medium
A Cross-Site Scripting (XSS) vulnerability was discovered in SeedDMS 6.0.13 via the folderid parameter in views/bootstrap/class.DropFolderChooser.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.
Original NVD description (English source)
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS