« Volver al listado

CVE-2019-18220

Estado: ModificadaAlta (8.8)—

Sitemagic CMS versión 4.4.1 está afectado por un problema de tipo Cross-Site-Request-Forgery (CSRF), ya que no implementa ningún método para comprobar las peticiones entrantes, lo que permite la ejecución de funcionalidades críticas por medio de peticiones falsas. Un atacante remoto no autenticado podría abusar de este comportamiento para engañar a los usuarios de Sitemagic para que realicen acciones injustificadas.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sitemagic — Sitemagic

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-18220",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-10-23T14:15:10.463",
  "references": [
    {
      "url": "https://github.com/Jemt/SitemagicCMS/blob/master/changelog.txt",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://vuldb.com/?id.144008",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/Jemt/SitemagicCMS/blob/master/changelog.txt",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://vuldb.com/?id.144008",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sitemagic CMS 4.4.1 is affected by a Cross-Site-Request-Forgery (CSRF) issue as it doesn't implement any method to validate incoming requests, allowing the execution of critical functionalities via spoofed requests. This behavior could be abused by a remote unauthenticated attacker to trick Sitemagic users into performing unwarranted actions."
    },
    {
      "lang": "es",
      "value": "Sitemagic CMS versión 4.4.1 está afectado por un problema de tipo Cross-Site-Request-Forgery (CSRF), ya que no implementa ningún método para comprobar las peticiones entrantes, lo que permite la ejecución de funcionalidades críticas por medio de peticiones falsas. Un atacante remoto no autenticado podría abusar de este comportamiento para engañar a los usuarios de Sitemagic para que realicen acciones injustificadas."
    }
  ],
  "lastModified": "2026-06-17T02:24:37.263",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sitemagic:sitemagic:4.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "542B3F5F-E08E-42DA-90F3-8755A228208C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}