Medium severity · published Jun 3, 2022
CVE-2020-36534
easyii CMS out cross-site request forgery
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was found in easyii CMS. It has been classified as problematic. Affected is an unknown function of the file /admin/sign/out. The manipulation leads to cross site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
CMS · easyii
All versions, or not specified · source: vendor
EA
Easyiicms · Easyiicms
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36534
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36534
Product
https://github.com/noumo/easyii/
Exploit
https://vuldb.com/?id.160278
More from CMS
9.8
CVE-2022-3771
easyii CMS File Upload Management Upload.php file unrestricted upload