TI-2020-19142 Aliases CVE-2020-37007 GHSA-wx76-4vvv-7j37

Liman 0.7 - Cross-Site Request Forgery (Change Password)

MEDIUM 62CWE-352Published 2026-01-29 · Updated 2026-03-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Tampering
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate user account settings without proper request validation. Attackers can craft malicious HTML forms to change user passwords or modify account information by tricking logged-in users into submitting unauthorized requests.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00197 9th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
salihciftci	Liman	0.7	—	No fix listed	CNA

Liman Vendorsalihciftci Affected 0.7 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:salihciftci:liman:0.7:::::::*	0.7	Vulnerable	salihciftci

cpe:2.3:a:salihciftci:liman:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·salihciftci

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-37007
2026-10-03 Alias added: GHSA-wx76-4vvv-7j37

References

Exploit 1

ExploitDB-48869

Other 1

Archived Liman GitHub Repository

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences