CVE-2023-4824

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Nov 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-482408.8XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difCVE-2023-482417.5XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the SolrCVE-2023-482426.5The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the apCVE-2023-482438.8The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS userCVE-2023-482446.1The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted UCVE-2023-482459.8The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) CVE-2023-482466.5The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS usCVE-2023-482477.5The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) viCVE-2023-482485.4The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script CVE-2023-482496.5The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the applCVE-2023-482509.8The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded acCVE-2023-482519.8The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.
CVE-2023-4824: High severity, CVSS 8.8 | Vulnix