« Volver al listado

CVE-2021-25976

Estado: ModificadaAlta (8.1)—

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dotnetfoundation — Piranha CMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-25976",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-25976",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-30T15:27:43.368969Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "HIGH",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "vulnerabilitylab@mend.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vulnerabilitylab@mend.io",
      "affectedData": [
        {
          "vendor": "PiranhaCMS",
          "product": "Piranha",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0-alpha1",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "9.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-11-16T09:15:06.717",
  "references": [
    {
      "url": "https://github.com/PiranhaCMS/piranha.core/commit/e42abacdd0dd880ce9cf6607efcc24646ac82eda",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "vulnerabilitylab@mend.io"
    },
    {
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25976",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vulnerabilitylab@mend.io"
    },
    {
      "url": "https://github.com/PiranhaCMS/piranha.core/commit/e42abacdd0dd880ce9cf6607efcc24646ac82eda",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25976",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vulnerabilitylab@mend.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known."
    },
    {
      "lang": "es",
      "value": "En PiranhaCMS, versiones 4.0.0-alpha1 a 9.2.0, son vulnerables a un ataque de tipo cross-site request forgery (CSRF) cuando son llevados a cabo varias acciones soportadas por el sistema de administración, como eliminar un usuario, eliminar un rol, editar un post, eliminar una carpeta multimedia, etc., cuando es conocido un ID"
    }
  ],
  "lastModified": "2026-06-17T03:42:42.850",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F9E149E-C7F5-45C4-B8E7-281DA462ACE0",
              "versionEndIncluding": "9.2",
              "versionStartIncluding": "4.0.1"
            },
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:4.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0ED15B81-94C3-4B09-961C-30EC75443BD9"
            },
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:4.0.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D18FCDE-95A3-4273-8335-105F6369137C"
            },
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:4.0.0:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CB135C7-1502-4E4B-915F-B05A1C1C12F7"
            },
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:4.0.0:alpha4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9285D604-1944-464A-9FCE-ED537051A34B"
            },
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:4.0.0:alpha5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "889D40DB-F01C-48B2-835B-D27E75E8C9D3"
            },
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:4.0.0:alpha6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F51560A6-10B0-4B34-B8BB-20C34816466B"
            },
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:4.0.0:alpha7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B7A98E2-BEBE-4060-8485-9D1C3F7E28C0"
            },
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:4.0.0:alpha8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16AFC166-E23C-4489-B1EC-AD999B11B40D"
            },
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:4.0.0:alpha9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "549FCD90-9B78-44CA-964F-BA37CE1B7D38"
            },
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:4.0.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7A3B84A-6CC7-4792-ABD9-BD66F0DB1F93"
            },
            {
              "criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:4.0.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64D9A271-9B90-4F5D-9E4F-53B83397B56A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnerabilitylab@mend.io"
}