PT-2015-4222 · E107 · E107

Published 2015-01-02 · Updated 2015-01-14 · CVE-2014-9459

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions e107 version 2.0 alpha2

Description A cross-site request forgery issue exists in the AdminObserver function, allowing remote attackers to hijack administrator authentication for requests that add users to the administrator group. This is achieved via the id parameter in an admin action.

Recommendations For e107 version 2.0 alpha2, consider disabling the AdminObserver function until a patch is available to prevent exploitation of this issue. Restrict access to admin actions that utilize the id parameter to minimize the risk of unauthorized user additions to the administrator group.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-9459

Affected Products

E107

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-9459 · Security Note
• https://github.com/e107inc/e107/commit/9249f892b1e635979db2a830393694fb73531080 · Note
• http://seclists.org/fulldisclosure/2014/Dec/124 · Note
• http://sroesemann.blogspot.de/2014/12/sroeadv-2014-04.html · Note
• http://packetstormsecurity.com/files/129751/e107-2.0-Alpha2-Cross-Site-Request-Forgery.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9459 · Note