PT-2015-4222 · E107 · E107

Publicado 2015-01-02 · Atualizado 2015-01-14 · CVE-2014-9459

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions e107 version 2.0 alpha2

Description A cross-site request forgery issue exists in the AdminObserver function, allowing remote attackers to hijack administrator authentication for requests that add users to the administrator group. This is achieved via the id parameter in an admin action.

Recommendations For e107 version 2.0 alpha2, consider disabling the AdminObserver function until a patch is available to prevent exploitation of this issue. Restrict access to admin actions that utilize the id parameter to minimize the risk of unauthorized user additions to the administrator group.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-9459

Produtos afetados

E107

Referências · 6

• https://github.com/e107inc/e107/commit/9249f892b1e635979db2a830393694fb73531080 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9459 · Nota de Segurança
• http://seclists.org/fulldisclosure/2014/Dec/124 · Nota
• http://sroesemann.blogspot.de/2014/12/sroeadv-2014-04.html · Nota
• http://packetstormsecurity.com/files/129751/e107-2.0-Alpha2-Cross-Site-Request-Forgery.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9459 · Nota