CVE-2026-34383

Katalog CVE

CVSS 3.5 · Low EPSS 0,15%

Kerentanan Improper Input Validation pada admidio. Skor CVSS 3.1 3.5 (Low) menurut NVD.

Deskripsi (NVD)

Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses both CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces. This issue has been patched in version 5.0.8.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

3.5 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Admidio/admidio/security/advisories/GHSA-4rwm-c5mj-wh7x exploit · mitigasi · advisory vendor
• https://github.com/Admidio/admidio/commit/00494b95dfe847af8b938e4397e5d909d8f36839 patch