CVE-2020-36389

    Dashboard / Vulnerabilities / CVE-2020-36389

    CVE-2020-36389

    Published: 17 Jun 2021Last Modified: 8 Jul 2026

    Summary:

    Details: In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.

    References: https://civicrm.org/advisory/civi-sa-2020-11-csrf-ckeditor-configuration-form, https://blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -be989a7051c7620136c4e6dbdb128f55d3b2b5f9

    Affected versions

    5.28.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-36389 | CVE-DB