Back to Database
Status published
High
CVE-2020-4040
CSRF issue on preview pages in Bolt CMS
Vulnerability Description
Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview. This has been fixed in Bolt 3.7.1
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-4040
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/bolt/bolt/security/advisories/GHSA-2q66-6cc3-6xm8
- https://github.com/bolt/bolt/pull/7853
- https://github.com/bolt/bolt/commit/b42cbfcf3e3108c46a80581216ba03ef449e419f
- http://packetstormsecurity.com/files/158299/Bolt-CMS-3.7.0-XSS-CSRF-Shell-Upload.html
- http://seclists.org/fulldisclosure/2020/Jul/4
More from bolt
View All →CVE-2022-36532
Bolt CMS contains a vulnerability in version 5.1.12 and below...
High
8.8
CVE-2021-40219
Bolt CMS <= 4.2 is vulnerable to Remote Code Execution....
High
8.8
CVE-2020-4041
The filename of uploaded files vulnerable to stored XSS in Bolt CMS
High
7.4
CVE-2018-19933
Bolt CMS <3.6.2 allows XSS via text input click preview...
Medium
6.1
Affected Vendor
bolt
View all reports →Affected Software
bolt
Vulnerable Versions:
< 3.7.1
Timeline
Official Publish:
June 8th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N