PatchTheCVElfdycms vulnerabilities
Recent CVEs affecting lfdycms products. 5 tracked.
lfdycms has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2018-12-30. Highest priority: CVE-2018-12603 (score 58/100).
- CVE-2018-20604 MEDIUM 4.9 DOWNGRADE Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ..* in Template/edit/path URIs
- CVE-2018-20603 HIGH 8.8 DOWNGRADE Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF.
- CVE-2018-20602 HIGH 7.5 DOWNGRADE Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI.
- CVE-2018-12603 HIGH 8.8 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack
- CVE-2018-12602 HIGH 8.8 DOWNGRADE A CSRF vulnerability exists in LFCMS 3.7.0: users can be added arbitrarily.
FAQ
How do I fix lfdycms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is lfdycms being exploited right now?
None of the tracked lfdycms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which lfdycms CVE should I patch first?
CVE-2018-12603 currently ranks highest (58/100): Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack .