PT-2010-3880 · Plume · Plume Cms

Publicado 2010-06-15 · Atualizado 2018-10-10 · CVE-2010-2294

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Plume CMS versions 1.2.4 and earlier

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that change the administrator password.

Recommendations For Plume CMS versions 1.2.4 and earlier, consider disabling password change functionality until a patch is available. Restrict access to administrator password change requests to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2010-2294

Produtos afetados

Plume Cms

Referências · 5

• http://vupen.com/english/advisories/2010/1430 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/59308 · Nota
• http://securityfocus.com/archive/1/511761/100/0/threaded · Nota
• http://secunia.com/advisories/40133 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2294 · Nota de Segurança