CVE-2024-2354

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in Dreamer CMS 4.1.3. Affected is an unknown function of the file /admin/menu/toEdit. The manipulation of the argument id leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Dreamer	CMS	4.1.3
dreamer_cms_project	dreamer_cms	4.1.3

References

https://github.com/sweatxi/BugHub/blob/main/dreamer_cms_admin_menu_toEdit_csrf.pdfBroken Link
https://vuldb.com/?ctiid.256314Permissions Required
https://vuldb.com/?id.256314Third Party Advisory
https://github.com/sweatxi/BugHub/blob/main/dreamer_cms_admin_menu_toEdit_csrf.pdfBroken Link
https://vuldb.com/?ctiid.256314Permissions Required
https://vuldb.com/?id.256314Third Party Advisory

Timeline

Published: Mar 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-235405.3The HCL BigFix Inventory server is vulnerable to path traversal which enables an attacker to read internal application files from the Invent CVE-2024-23553.7A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. Affected by this vulnerability is a CVE-2024-235505.5HCL DevOps Deploy / HCL Launch (UCD) could disclose sensitive user information when installing the Windows agent.CVE-2024-235516.5Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has b CVE-2024-235535.4A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header CVE-2024-235548.8Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).CVE-2024-235567.5SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.CVE-2024-235574.3HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not,CVE-2024-235586.3HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user CVE-2024-235596.1HCL DevOps Deploy / Launch is generating an obsolete HTTP header.CVE-2024-23569.6A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifica CVE-2024-235604.9HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type.