sdcms vulnerabilities and fixes

Recent CVEs affecting sdcms, with upgrade or downgrade steps. 5 tracked.

sdcms has 5 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2019-03-11. Highest priority: CVE-2019-9651 (score 66/100).

• CVE-2019-9652 HIGH 8.8 DOWNGRADE There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request
• CVE-2019-9651 CRITICAL 9.8 DOWNGRADE An issue was discovered in SDCMS V1.7
• CVE-2018-19748 HIGH 7.5 DOWNGRADE app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&
• CVE-2018-19520 HIGH 8.8 DOWNGRADE UPGRADE An issue was discovered in SDCMS 1.6 with PHP 5.x
• CVE-2018-11004 HIGH 8.8 DOWNGRADE An issue was discovered in SDcms v1.5

FAQ

How do I fix sdcms vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is sdcms being exploited right now?

None of the tracked sdcms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which sdcms CVE should I patch first?

CVE-2019-9651 currently ranks highest (66/100): An issue was discovered in SDCMS V1.7.

RSS feed for sdcms · ← Back to latest CVEs