CVE-2020-4040

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview. This has been fixed in Bolt 3.7.1

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
bolt	bolt	< 3.7.1

References

http://packetstormsecurity.com/files/158299/Bolt-CMS-3.7.0-XSS-CSRF-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Jul/4Exploit, Mailing List, Third Party Advisory
https://github.com/bolt/bolt/commit/b42cbfcf3e3108c46a80581216ba03ef449e419fPatch, Third Party Advisory
https://github.com/bolt/bolt/pull/7853Patch, Third Party Advisory
https://github.com/bolt/bolt/security/advisories/GHSA-2q66-6cc3-6xm8Patch, Third Party Advisory
http://packetstormsecurity.com/files/158299/Bolt-CMS-3.7.0-XSS-CSRF-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Jul/4Exploit, Mailing List, Third Party Advisory
https://github.com/bolt/bolt/commit/b42cbfcf3e3108c46a80581216ba03ef449e419fPatch, Third Party Advisory
https://github.com/bolt/bolt/pull/7853Patch, Third Party Advisory
https://github.com/bolt/bolt/security/advisories/GHSA-2q66-6cc3-6xm8Patch, Third Party Advisory

Timeline

Published: Jun 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40416.1In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code CVE-2020-40426.8Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret i CVE-2020-40439.8phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted CVE-2020-40447.8The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp CVE-2020-40457.5SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly CVE-2020-40465.4In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inj CVE-2020-40476.8In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media CVE-2020-40485.7In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted CVE-2020-40492.4In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript CVE-2020-40503.1In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It CVE-2020-40515.4In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less tha CVE-2020-40526.1In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure v