CyberRota Analysis
AI-GeneratedLektor versions 3.3.14 and 3.4.0b15 are vulnerable to a cross-site request forgery (CSRF) flaw in the admin API, allowing unauthenticated attackers to execute state-changing actions without proper validation mechanisms. This vulnerability can be exploited to manipulate content, delete records, and disclose sensitive data through malicious web pages. Organizations using these Lektor versions, particularly those with exposed admin APIs, should prioritize immediate remediation to mitigate potential data breaches and unauthorized actions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can exploit the newattachment, deleterecord, build, clean, and publish endpoints from a malicious web page to write arbitrary files, delete pages, wipe build output, trigger deployment publication, and via DNS rebinding reach read endpoints to disclose data.