PT-2013-3859 · Light Feed · Leed

Alexandre Herzog · Published 2013-12-21 · Updated 2013-12-23 · CVE-2013-2628

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Leed (Light Feed) versions prior to 1.5 Stable

Description The issue is related to multiple cross-site request forgery (CSRF) vulnerabilities in the action.php file. These vulnerabilities could allow remote attackers to hijack the authentication of administrators for unspecified requests due to the lack of an anti-CSRF token.

Recommendations For versions prior to 1.5 Stable, update to version 1.5 Stable or later to resolve the issue. As a temporary workaround, consider implementing additional security measures to prevent CSRF attacks, such as validating request origins and verifying user intentions.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2013-2628

Affected Products

Leed

References · 4

• 🔥 http://csnc.ch/misc/files/advisories/CSNC-2013-005-006-007_Leed_Multiple_vulns.txt · Exploit
• 🔥 http://seclists.org/bugtraq/2013/Dec/107 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-2628 · Security Note
• http://osvdb.org/101154 · Note