← All advisories

Medium severity4.3NVD Advisory· Published Jun 17, 2021· Updated Jun 17, 2026

CVE-2020-36389

CVE-2020-36389

Description

In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5

Civicrm/Civicrm3 versions
cpe:2.3:a:civicrm:civicrm:*:*:*:*:-:*:*:*+ 2 more
- cpe:2.3:a:civicrm:civicrm:*:*:*:*:-:*:*:*range: <5.28.1
- cpe:2.3:a:civicrm:civicrm:*:*:*:*:extended_security_release:*:*:*range: <5.27.5
- (no CPE)range: <5.28.1
CiviCRM/CiviCRMdescription
osv-coords
pkg:bitnami/civicrm
Range: < 5.27.5

Patches

Vulnerability mechanics

References

2

blog.sonarsource.com/civicrm-code-execution-vulnerability-chain-explained/nvdExploitThird Party Advisory
civicrm.org/advisory/civi-sa-2020-11-csrf-ckeditor-configuration-formnvdVendor Advisory

News mentions

0

No linked articles in our index yet.