CVE-2024-41597
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability was found in ProcessWire version 3.0.229, allowing a remote attacker to insert a comment. The supplier disputes this, stating the product intentionally accepts anonymous, unauthenticated comments and that submitted comments are held for moderator review by default.
Risk Assessment
The risk involves an attacker adding unwanted comments without administrator knowledge, potentially leading to content spam or social engineering attacks, though the risk is mitigated by default moderation.
Recommendation
It is recommended to update to the latest version of ProcessWire and enable CSRF protection mechanisms if available. Also, regularly monitor and moderate submitted comments.
Original NVD description (English source)
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situations in which CSRF would be a useful attack technique. Also, the submitted comments are, by default, held for moderator review.