CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in SEMrush CY LTD Semrush Content Toolkit semrush-contentshake allows Cross Site Request Forgery.This issue affects Semrush Content Toolkit: from n/a through <= 1.1.32.
Explanation of Vulnerability in Simple Terms
Semrush Content Toolkit versions up to 1.1.32 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in user, performs unwanted actions on their behalf without their knowledge. The vulnerability requires user interaction—the victim must visit the attacker's page while authenticated to the toolkit.
What an attacker can do
Perform unwanted actions on a user's account by tricking them into visiting a malicious webpage.
Potential impact on your site
Users' accounts and data in the toolkit can be modified or deleted without their consent if they visit a malicious link.
Conditions required to exploit
User must be logged into Semrush Content Toolkit and visit an attacker-controlled webpage.
Key dates
External resources
Related vulnerabilities
