PT-2010-3868 · Tomato · Tomatocms

Published 2010-06-14 · Updated 2010-06-17 · CVE-2010-2282

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TomatoCMS version 2.0.6

Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that change the administrative password.

Recommendations For TomatoCMS version 2.0.6, update to a version that fixes this issue to prevent authentication hijacking.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2010-2282

Affected Products

Tomatocms

References · 5

• 🔥 https://exploit-db.com/exploits/14331 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2282 · Security Note
• http://secunia.com/advisories/39680 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2282 · Note
• http://holisticinfosec.org/content/view/148/45 · Note