Attacker Value
Moderate
CVE-2020-35687
CVE-2020-35687
(Last updated October 07, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Execution
Techniques
Validation
Impact
Techniques
Validation
Initial Access
Techniques
Validation
Description
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.
Add Assessment
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
4.3 Medium
Impact Score:
1.4
Exploitability Score:
2.8
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
Low
Availability (A):
None
General Information
Vendors
- php-fusion
Products
- phpfusion 9.03.90
Hey @oosman-rak ! I saw you reported this as exploited in the wild, but I haven’t been able to find any sources on exploitation myself. I’m definitely interested in knowing where this is being exploited so we can maybe make a note to look into it!