« Back to list

CVE-2021-35343

Status: ModifiedMedium (4.3)—

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Seeddms — Seeddms

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2021-35343",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-03T19:15:08.883",
  "references": [
    {
      "url": "https://medium.com/%40cyberdivision/cve-2021-35343-c5c298cbb2d4",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://medium.com/%40cyberdivision/cve-2021-35343-c5c298cbb2d4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated user to visit an attacker's web page."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el archivo /op/op.Ajax.php en SeedDMS versiones v5.1.x anteriores a 5.1.23 y versiones v6.0.x anteriores a 6.0.16, permite a un atacante remoto editar el nombre de un documento sin el conocimiento de la víctima, al tentar a un usuario autenticado a visitar una página web del atacante"
    }
  ],
  "lastModified": "2026-06-17T03:57:27.207",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:seeddms:seeddms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6790ECF-31C6-4F03-9268-ACB5DA4A935D",
              "versionEndExcluding": "5.1.23",
              "versionStartIncluding": "5.1.0"
            },
            {
              "criteria": "cpe:2.3:a:seeddms:seeddms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F950D07-4460-4B2A-BCF6-267F1C30D5A6",
              "versionEndExcluding": "6.0.16",
              "versionStartIncluding": "6.0.7"
            },
            {
              "criteria": "cpe:2.3:a:seeddms:seeddms:6.0.6:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C48DCDD-0C1D-449D-A2D1-79E94508B679"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}