TI-2024-09138 Aliases CVE-2024-9847 GHSA-x2w2-frfv-4f2j

Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress

HIGH 70CWE-352Published 2025-03-20 · Updated 2025-03-20

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a request to the FlatPress CMS server to perform the desired action on behalf of the victim user. Since the request is authenticated, the server will process it as if it were initiated by the legitimate user, effectively allowing the attacker to perform unauthorized actions. This vulnerability is fixed in version 1.4.dev.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00342 27th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed flatpressblog/flatpress (flatpressblog): 1.4.dev

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
flatpressblog	flatpressblog/flatpress	before 1.4.dev	1.4.dev	Patch available	CNA

flatpressblog/flatpress Vendorflatpressblog Affected before 1.4.dev Fixed in 1.4.dev Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:flatpress:flatpress::::::::	before 1.4	Vulnerable	flatpressblog

cpe:2.3:a:flatpress:flatpress:*:*:*:*:*:*:*:* Versions before 1.4 Vulnerable ·flatpressblog

Remediation

Fix · CNA flatpressblog/flatpress (flatpressblog) Fixed in 1.4.dev

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-03-20
flatpressblog/flatpress 1.4.dev
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2024-08996 Cross-Site Scripting (XSS) in flatpressblog/flatpressPriority MEDIUM 60
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-9847
2026-10-03 Alias added: GHSA-x2w2-frfv-4f2j

References

Exploit 1

https://huntr.com/bounties/b30ef7b0-74ea-4cac-adc4-1cc8a5cb559e

Patch 1

https://github.com/flatpressblog/flatpress/commit/a81c968f51f134b5e5f9bbe208aa12f4fbc329df

TI-2023-00898 Path Traversal in flatpressblog/flatpress CVSS 3.1CRITICAL 9.8
TI-2022-04209 PHP Remote File Inclusion in flatpressblog/flatpress CVSS 3.1CRITICAL 9.8
TI-2023-01045 External Control of File Name or Path in flatpressblog/flatpress CVSS 3.1HIGH 8.1
TI-2022-18965 Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function. CVSS 3.1HIGH 7.2
TI-2024-03752 Stored XSS in flatpressblog/flatpress CVSS 3.0HIGH 8.1
TI-2022-04208 Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress CVSS 3.1MEDIUM 5.4

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences