PT-2020-7806 · Atutor · Atutor

Published 2020-03-02 · Updated 2020-03-04 · CVE-2015-1583

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: ATutor version 2.2

Description: The issue allows remote attackers to hijack the authentication of administrators for requests that create an administrator account via a request to "mods/ core/users/admins/create.php" or create a user account via a request to "mods/ core/users/create user.php". This is due to multiple cross-site request forgery (CSRF) vulnerabilities.

Recommendations: For ATutor version 2.2, as a temporary workaround, consider disabling access to the "mods/ core/users/admins/create.php" and "mods/ core/users/create user.php" endpoints until a patch is available. Restrict access to these endpoints to minimize the risk of exploitation. Avoid using these endpoints in administrative tasks until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-1583

Affected Products

Atutor

References · 8

• 🔥 https://edricteo.com/cve-2015-1583-atutor-lcms-csrf-vulnerability · Exploit
• 🔥 http://packetstormsecurity.com/files/130598/ATutor-LCMS-2.2-Cross-Site-Request-Forgery.html · Exploit
• https://github.com/atutor/ATutor/commit/0ee827317e497f1db86ddc5080b8af461e4595ce · Patch
• https://github.com/atutor/ATutor/commit/af519cfb56da7312eecbb5812484fcbce08e4419 · Patch
• https://github.com/atutor/ATutor/commit/068b8aa37f24645c62235018fb8da340f60e2d18 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-1583 · Security Note
• http://securityfocus.com/bid/72845 · Note
• https://t.me/cibsecurity/10216 · Telegram Post