CVE-2021-25976

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-25976
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25976.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-25976
Aliases
Published
2021-11-16T09:15:06.717Z
Modified
2026-04-10T04:31:11.421419Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
Summary
[none]
Details

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.

References

Affected packages

Git / github.com/piranhacms/piranha.core

Affected ranges

Type
GIT
Repo
https://github.com/piranhacms/piranha.core
Events
Introduced
c5b65aad9762e144bb9adfad317fa34b7dcf97b6
Last affected
22a84b85fd30946b4ca93240e51c38d23e694acc
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
504e9a51c72e517cad14f3f8bfc7dcc65879d769
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
91bc55f696e01bd3bafac3b904a3e355c97bdc7e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
427d71bcb62769e135cc814c4e850ee2f806976a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
cbc40b4812a6d7c0c8bd51129c1b330cb538cda4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
80be7e6155994d61b4b2b53532d76d9b98286ae4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0ed1ffb3c87be6b57c1a3b225f9930f565ec1db7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
11d71fbb50637aa5fc44442d35dcd66cb9dbfd07
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
369b4a65aefe9a202da4e56cb9a11d3e1a1e6d7c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3bf3c99df291487e6e60b0a9bfaa96111382486f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
83016dbde65276e8c09ef67c7d163dedaff591ba
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9d7722e6b0e85f8e7c3be20fe1189ff04457db31
Fixed
e42abacdd0dd880ce9cf6607efcc24646ac82eda
Database specific 
{
    "versions": [
        {
            "introduced": "4.0.1"
        },
        {
            "last_affected": "9.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.0-alpha1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.0-alpha3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.0-alpha4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.0-alpha5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.0-alpha6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.0-alpha7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.0-alpha8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.0-alpha9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.0-beta1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0.0-rc1"
        }
    ]
}

Affected versions

v4.*
v4.0.0
v4.0.0-alpha1
v4.0.0-alpha3
v4.0.0-alpha4
v4.0.0-alpha5
v4.0.0-alpha6
v4.0.0-alpha7
v4.0.0-alpha8
v4.0.0-alpha9
v4.0.0-beta1
v4.0.0-rc1
v4.0.1
v4.1.0
v4.1.0-alpha1
v4.1.0-beta1
v4.1.0-beta2
v4.2.0
v4.2.0-alpha1
v4.2.0-alpha2
v4.2.0-beta1
v4.2.1
v4.3.0
v4.3.0-beta1
v5.*
v5.0.0
v5.0.0-alpha1
v5.0.0-beta1
v5.0.1
v5.1.0
v5.1.0-alpha1
v5.1.0-beta1
v5.1.1
v5.1.2
v5.2.0
v5.2.0-beta1
v5.2.0-beta2
v5.2.1
v5.3.0
v5.3.0-beta1
v5.3.1
v5.4.0
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.1.0
v7.*
v7.0-sr2
v7.0-sr3
v7.0-sr4
v7.0-sr5
v7.0.0
v7.0.0-alpha1
v7.0.0-alpha2
v7.0.0-beta1
v7.0.1
v7.1.0
v8.*
v8.0
v8.0-sr1
v8.1
v8.2
v8.3
v8.3-sr1
v8.3-sr2
v8.4
v8.4-sr1
v8.4-sr2
v8.4-sr3
v9.*
v9.0
v9.0-beta1
v9.0-rc1
v9.0-rc2
v9.0-sr1
v9.1
v9.1-alpha1
v9.1-alpha2
v9.1-beta1
v9.1-sr1
v9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25976.json"