CVE-2017-6914

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. A user can be deleted.

Metrics

CVSS 3.0 7.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdfExploit, Technical Description, Third Party Advisory
https://github.com/bigtreecms/BigTree-CMS/issues/275Patch, Vendor Advisory
https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdfExploit, Technical Description, Third Party Advisory
https://github.com/bigtreecms/BigTree-CMS/issues/275Patch, Vendor Advisory

Timeline

Published: Mar 15, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-69154.3CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page. The Colophon can be changed.CVE-2017-69164.3CSRF exists in BigTree CMS 4.1.18 with the nav-social[#] parameter to the admin/settings/update/ page. The Navigation Social can be changed.CVE-2017-69174.3CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Colophon can be changed.CVE-2017-69184.3CSRF exists in BigTree CMS 4.2.16 with the value[#][*] parameter to the admin/settings/update/ page. The Navigation Social can be changed.CVE-2017-69197.5Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is CVE-2017-69209.8Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects s CVE-2017-69215.9In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected b CVE-2017-69226.5In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not perm CVE-2017-69236.5In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views CVE-2017-69247.4In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even CVE-2017-69259.8In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, CVE-2017-69268.1In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have