PT-2018-13280 · E107 · E107

Dhananjay Bajaj · Publicado 2018-08-28 · Atualizado 2018-11-02 · CVE-2018-15901

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions e107 version 2.1.8

Description The issue allows for Cross-Site Request Forgery (CSRF) attacks in the 'usersettings.php' file, enabling an attacker to change user details, including passwords, for all users, including administrators.

Recommendations For e107 version 2.1.8, consider implementing CSRF protection mechanisms, such as tokens, to prevent unauthorized changes to user settings, including passwords, until a patch is available. As a temporary workaround, restrict access to the 'usersettings.php' file to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-15901

Produtos afetados

E107

Referências · 5

• 🔥 https://github.com/dhananjay-bajaj/e107_2.1.8_csrf/blob/master/E107_v2.1.8_CSRF_POC.pdf · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15901 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15901 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15901 · Aviso do Fabricante
• https://github.com/dhananjay-bajaj/e107_2.1.8_csrf · Nota