PT-2014-3296 · Simple Machines · Simple Machines Forum

Jakob Lell · Published 2014-04-29 · Updated 2014-04-30 · CVE-2013-7234

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) versions prior to 1.1.19 Simple Machines Forum (SMF) versions 2.x prior to 2.0.6

Description The issue allows remote attackers to conduct clickjacking attacks. This is possible due to the lack of an appropriate X-Frame-Options header, which enables an attacker to frame the vulnerable application, potentially leading to unintended actions by the user.

Recommendations For versions prior to 1.1.19, update to version 1.1.19 or later. For versions 2.x prior to 2.0.6, update to version 2.0.6 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-7234

Affected Products

Simple Machines Forum

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-7234 · Security Note
• http://jakoblell.com/blog/2013/12/13/multiple-vulnerabilities-in-smf-forum-software · Note
• http://openwall.com/lists/oss-security/2013/12/30/3 · Note
• http://seclists.org/fulldisclosure/2013/Dec/83 · Note
• http://openwall.com/lists/oss-security/2013/12/30/1 · Note
• http://download.simplemachines.org/index.php?thanks%3Bfilename=smf_2-0-6_changelog.txt · Note