PT-2010-4949 · Mojoportal · Mojoportal

George Birbilis · Published 2010-09-24 · Updated 2017-08-17 · CVE-2010-3603

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mojoPortal versions 2.3.4.3 through 2.3.5.1

Description A cross-site request forgery (CSRF) issue exists in the file manager service, specifically in the Services/FileService.ashx endpoint. This allows remote attackers to hijack the authentication of administrators, enabling them to rename arbitrary files. For example, an attacker could cause the user.config file to be moved, resulting in a denial of service (service stop) and potentially exposing sensitive information.

Recommendations For versions 2.3.4.3 and 2.3.5.1, consider disabling the Services/FileService.ashx endpoint until a patch is available to prevent exploitation of the CSRF vulnerability. Restrict access to the file manager service to minimize the risk of unauthorized file modifications.

Exploit

Fix

DoS

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2010-3603

Affected Products

Mojoportal

References · 10

• 🔥 http://packetstormsecurity.org/1009-exploits/moaub-mojoportal.txt · Exploit
• 🔥 http://packetstormsecurity.org/1009-advisories/moaub16-mojoportal.pdf · Exploit
• 🔥 https://exploit-db.com/exploits/15018 · Exploit
• 🔥 http://exploit-db.com/exploits/15018 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-3603 · Security Note
• http://secunia.com/advisories/41481 · Vendor Advisory
• http://mojoportal.com/mojoportal-2352-released.aspx · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3603 · Note
• http://osvdb.org/68060 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61834 · Note