Cross-site request forgery in Page Builder by SiteOrigin - #VU27866
Published: May 13, 2020
Vulnerability identifier: #VU27866
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin in the live editor and action_builder_content functions. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website, leading to XSS.
Affected software
Page Builder by SiteOrigin
Remediation
Install updates from vendor's website.
Page Builder by SiteOrigin - update to 2.10.16