Vulnerability · Published Dec 16, 2022 · Assigned by VulDB
CVE-2022-4564University of Central Florida Materia API Controller api.php before cross-site request forgery
Medium 4.3
In plain English
A medium-severity cross-site request forgery in Materia from University of Central Florida. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fuel/app/classes/controller/api.php of the component API Controller. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 9.0.1-alpha1 is able to address this issue. The name of the patch is af259115d2e8f17068e61902151ee8a9dbac397b. It is recommended to upgrade the affected component. The identifier VDB-215973 was assigned to this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| University of Central Florida | Materia | 9.0 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://vuldb.com/?id.215973 technical-description, vdb-entry
- https://github.com/ucfopen/Materia/pull/1371 related
- https://github.com/ucfopen/Materia/commit/af259115d2e8f17068e61902151ee8a9dbac397b mitigation, patch
- https://github.com/ucfopen/Materia/releases/tag/v9.0.1-alpha1 mitigation