PT-2023-10127 · Unknown · Mrobit Robitailletheknot

Published 2023-01-07 · Updated 2024-05-17 · CVE-2014-125057

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions mrobit robitailletheknot (affected versions not specified)

Description A vulnerability was found in the component CSRF Token Handler, affecting an unknown part of the file app/filters.php. The manipulation of the argument token leads to incorrect comparison. It is possible to initiate the attack remotely. The complexity of an attack is rather high, and the exploitability is told to be difficult.

Recommendations To fix this issue, it is recommended to apply a patch named 6b2813696ccb88d0576dfb305122ee880eb36197. As a temporary workaround, consider restricting the manipulation of the token argument in the app/filters.php file until the patch is applied. Additionally, restrict access to the vulnerable component CSRF Token Handler to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2014-125057

Affected Products

Mrobit Robitailletheknot

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-125057 · Security Note
• https://github.com/mrobit/robitailletheknot/commit/6b2813696ccb88d0576dfb305122ee880eb36197 · Patch
• https://t.me/cvenotify/41478 · Telegram Post
• https://vuldb.com/?id.217599 · Note
• https://t.me/cibsecurity/56114 · Telegram Post
• https://vuldb.com/?ctiid.217599 · Note