CVE-2025-55045

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-55045", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-19T13:54:33.731Z", "dateReserved": "2025-08-06T00:00:00.000Z", "datePublished": "2026-03-18T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-18T15:56:57.729Z"}, "descriptions": [{"lang": "en", "value": "The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. The vulnerable cUsers.updateAddress function lacks CSRF token validation, enabling malicious websites to forge requests that add, modify, or delete user addresses when an authenticated administrator visits a crafted webpage. Successful exploitation of the update address CSRF vulnerability results in unauthorized manipulation of user address information within the MuraCMS system, potentially compromising user data integrity and organizational communications. When an authenticated administrator visits a malicious webpage containing the CSRF exploit, their browser automatically submits a hidden form that can add malicious addresses with attacker-controlled email addresses and phone numbers, update existing addresses to redirect communications to attacker-controlled locations or deleted legitimate address records to disrupt business operations. This can lead to misdirected sensitive communications, compromise of user privacy through injection of attacker contact information, disruption of legitimate business correspondence, and potential social engineering attacks via the corrupted address data."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.murasoftware.com"}, {"url": "https://docs.murasoftware.com/v10/release-notes/"}, {"url": "https://docs.murasoftware.com/v10/release-notes/#section-version-1014"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T13:53:33.075384Z", "id": "CVE-2025-55045", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T13:54:33.731Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-55045", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-19T13:53:33.075384Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T13:54:17.304Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.murasoftware.com"}, {"url": "https://docs.murasoftware.com/v10/release-notes/"}, {"url": "https://docs.murasoftware.com/v10/release-notes/#section-version-1014"}], "descriptions": [{"lang": "en", "value": "The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. The vulnerable cUsers.updateAddress function lacks CSRF token validation, enabling malicious websites to forge requests that add, modify, or delete user addresses when an authenticated administrator visits a crafted webpage. Successful exploitation of the update address CSRF vulnerability results in unauthorized manipulation of user address information within the MuraCMS system, potentially compromising user data integrity and organizational communications. When an authenticated administrator visits a malicious webpage containing the CSRF exploit, their browser automatically submits a hidden form that can add malicious addresses with attacker-controlled email addresses and phone numbers, update existing addresses to redirect communications to attacker-controlled locations or deleted legitimate address records to disrupt business operations. This can lead to misdirected sensitive communications, compromise of user privacy through injection of attacker contact information, disruption of legitimate business correspondence, and potential social engineering attacks via the corrupted address data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-18T15:56:57.729Z"}}}, "cveMetadata": {"cveId": "CVE-2025-55045", "state": "PUBLISHED", "dateUpdated": "2026-03-19T13:54:33.731Z", "dateReserved": "2025-08-06T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-18T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:murasoftware:mura_cms:-:*:*:*:*:*:*:*", "matchCriteriaId": "CB4646EE-1255-4B42-890A-E0B57EBFE2CE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. The vulnerable cUsers.updateAddress function lacks CSRF token validation, enabling malicious websites to forge requests that add, modify, or delete user addresses when an authenticated administrator visits a crafted webpage. Successful exploitation of the update address CSRF vulnerability results in unauthorized manipulation of user address information within the MuraCMS system, potentially compromising user data integrity and organizational communications. When an authenticated administrator visits a malicious webpage containing the CSRF exploit, their browser automatically submits a hidden form that can add malicious addresses with attacker-controlled email addresses and phone numbers, update existing addresses to redirect communications to attacker-controlled locations or deleted legitimate address records to disrupt business operations. This can lead to misdirected sensitive communications, compromise of user privacy through injection of attacker contact information, disruption of legitimate business correspondence, and potential social engineering attacks via the corrupted address data."}, {"lang": "es", "value": "La vulnerabilidad CSRF de actualizaci\u00f3n de direcci\u00f3n en MuraCMS hasta la versi\u00f3n 10.1.10 permite a los atacantes manipular la informaci\u00f3n de direcci\u00f3n del usuario a trav\u00e9s de CSRF. La funci\u00f3n vulnerable cUsers.updateAddress carece de validaci\u00f3n de token CSRF, lo que permite a sitios web maliciosos forjar solicitudes que a\u00f1aden, modifican o eliminan direcciones de usuario cuando un administrador autenticado visita una p\u00e1gina web dise\u00f1ada. La explotaci\u00f3n exitosa de la vulnerabilidad CSRF de actualizaci\u00f3n de direcci\u00f3n resulta en la manipulaci\u00f3n no autorizada de la informaci\u00f3n de direcci\u00f3n del usuario dentro del sistema MuraCMS, comprometiendo potencialmente la integridad de los datos del usuario y las comunicaciones organizacionales. Cuando un administrador autenticado visita una p\u00e1gina web maliciosa que contiene el exploit CSRF, su navegador env\u00eda autom\u00e1ticamente un formulario oculto que puede a\u00f1adir direcciones maliciosas con direcciones de correo electr\u00f3nico y n\u00fameros de tel\u00e9fono controlados por el atacante, actualizar direcciones existentes para redirigir comunicaciones a ubicaciones controladas por el atacante o eliminar registros de direcciones leg\u00edtimas para interrumpir las operaciones comerciales. Esto puede llevar a comunicaciones sensibles mal dirigidas, compromiso de la privacidad del usuario mediante la inyecci\u00f3n de informaci\u00f3n de contacto del atacante, interrupci\u00f3n de la correspondencia comercial leg\u00edtima y posibles ataques de ingenier\u00eda social a trav\u00e9s de los datos de direcci\u00f3n corruptos."}], "id": "CVE-2025-55045", "lastModified": "2026-06-17T09:41:09.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55045", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-19T13:53:33.075384Z", "version": "2.0.3"}}]}, "published": "2026-03-18T16:16:23.670", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://docs.murasoftware.com/v10/release-notes/"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://docs.murasoftware.com/v10/release-notes/#section-version-1014"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.murasoftware.com"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.1.10]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 98.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "mura_cms", "vendor": "murasoftware"}], "analysis": {"en": {"generated_at": "2026-03-20T19:26:19.006814+00:00", "value": {"mitigation_remediation": ["Upgrade MuraCMS to version 10.1.10 or later based on the vendor release notes.", "Verify that the cUsers.updateAddress endpoint now requires a valid CSRF token.", "Restrict administrative access to trusted networks and enforce two\u2011factor authentication to reduce the window of opportunity for CSRF links.", "Educate administrators to avoid visiting untrusted webpages while logged into the CMS."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized manipulation of user address data"}, "threat_synthesis": {"affected_systems": "The weakness exists in MuraCMS up to and including version 10.1.10; earlier releases are also impacted, as the issue was not fixed until the 10.1.10 release notes explain the update. Administrators using MuraCMS 10.1.10 or earlier are at risk, regardless of the specific deployment location.", "description_and_impact": "A cross\u2011site request forgery flaw in the cUsers.updateAddress routine allows a malicious site to send requests that add, modify, or delete addresses on behalf of a logged\u2011in administrator. The attack can inject attacker\u2011controlled email or phone numbers, overwrite legitimate addresses, or remove them entirely, thereby corrupting business communication channels and exposing sensitive contact information. The vulnerability leverages missing CSRF token validation and directly affects the integrity of user address records within MuraCMS.", "risk_and_exploitability": "The CVSS score of 7.1 indicates a high severity condition. EPSS shows a probability of exploitation below 1\u202f%, and the flaw is not present in CISA\u2019s Known Exploited Vulnerabilities list. Exploitation requires an authenticated administrator who inadvertently visits a malicious website; the attacker therefore exploits the lack of CSRF validation during an active session. Once the request is sent, the attacker can alter user data with the administrator\u2019s privileges."}}}}, "created": "2026-03-19T08:57:08.784840+00:00", "title": "CSRF Vulnerability in MuraCMS User Address Update Function", "updated": "2026-03-24T10:54:09.922915+00:00", "vendors": ["murasoftware", "murasoftware$PRODUCT$mura_cms"]}