-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django-cms | pip | < 3.0.14 | 3.0.14 |
| django-cms | pip | >= 3.1.0b1, < 3.1.1 | 3.1.1 |
Miggo AIRoot Cause AnalysisThe commit f77cbc6 added @require_POST decorators to multiple view functions in pageadmin.py, indicating these endpoints previously accepted GET requests for state-changing actions. CSRF vulnerabilities arise when such actions lack proper HTTP method enforcement and CSRF token validation. The JavaScript changes (switching from GET to POST with CSRF tokens) and test updates (testing POST instead of GET) further confirm these functions were vulnerable to CSRF via GET-based exploitation.
Ongoing coverage of React2Shell