Security readout for executives and security teams
Plain-English summary
CVE-2017-9365 is a cross-site request forgery issue in BigTree CMS through 4.2.18. A logged-in administrator could be tricked into causing a page revision action, such as unlocking a page, without intending to. The business impact appears limited to CMS administrative integrity, but affected deployment details are incomplete.
Executive priority
Treat as a scheduled remediation unless BigTree CMS admin access is internet-exposed or used by high-privilege content teams. Prioritize confirmation of affected versions because the public CVE metadata is sparse.
Technical view
The CVE describes CSRF on the force parameter in BigTree CMS admin page revisions handling at /admin/pages/revisions.php. The reported example concerns unlocking page id 1 via a crafted admin revision URL. No CVSS score, CWE, or complete affected CPE data is provided in the source bundle.
Likely exposure
Exposure is likely limited to organizations running BigTree CMS through 4.2.18, especially where administrators maintain active sessions and can be induced to visit attacker-controlled content. The source bundle does not identify affected CPEs or hosted service exposure.
Exploitation context
The bundle does not indicate active exploitation, and the CVE is not listed as KEV. Practical abuse would depend on a valid administrator session and missing CSRF protection around the affected revision action.
Researcher notes
The strongest source detail is the CVE description and upstream GitHub references. The affected field in the bundle is incomplete, while the title and description name BigTree CMS through 4.2.18. Avoid assuming broader impact beyond the admin page revision force parameter.
Mitigation direction
- Review BigTree CMS issue #281 and the linked commit for vendor remediation details.
- Upgrade BigTree CMS if vendor guidance identifies a fixed release.
- Limit access to the CMS admin interface to trusted networks or VPN users.
- Ensure administrative actions require anti-CSRF protections and intentional confirmation.
- Train administrators to avoid untrusted links while authenticated to the CMS.
Validation and detection
- Inventory all BigTree CMS deployments and identify versions through 4.2.18.
- Check whether /admin/pages/revisions.php is reachable only by authorized administrators.
- Review the revision unlock workflow for CSRF token enforcement.
- Inspect CMS audit logs for unexpected page unlock or revision activity.
- Confirm remediation against vendor issue #281 and the referenced commit.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9365 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/bigtreecms/BigTree-CMS/issues/281CVE reference · x_refsource_CONFIRM
- https://github.com/bigtreecms/BigTree-CMS/commit/c17d09b05d9c20c214ee2f4fbb52f7307a7b4b6fCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.