« Volver al listado

CVE-2026-28281

Estado: AnalizadaAlta (7.1)—

InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-352 (CSRF) sin validación de tokens permite crear cuentas moderador y elevar privilegios (AV:N, UI:R). Impacto: creación/modificación de cuentas (T1098.002) y escalada de privilegios (T1548.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementOperating System ConfigurationMulti-factor AuthenticationDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

Instantcms — Instantcms

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-28281",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28281",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-10T14:33:44.185664Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "instantsoft",
          "product": "icms2",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.18.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-10T17:38:39.103",
  "references": [
    {
      "url": "https://github.com/instantsoft/icms2/security/advisories/GHSA-pp43-262q-h73m",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1."
    },
    {
      "lang": "es",
      "value": "InstantCMS es un sistema de gestión de contenido gratuito y de código abierto. Antes de la versión 2.18.1, InstantCMS no valida los tokens CSRF, lo que permite a los atacantes otorgar privilegios de moderador a los usuarios, ejecutar tareas programadas, mover publicaciones a la papelera y aceptar solicitudes de amistad en nombre del usuario. Esta vulnerabilidad está corregida en la versión 2.18.1."
    }
  ],
  "lastModified": "2026-06-17T10:28:25.497",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "941170FC-010F-46A8-9479-0D66316AF116",
              "versionEndExcluding": "2.18.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}