fkie_cve-2011-4947
Vulnerability from fkie_nvd
Published
2012-08-31 22:55
Modified
2024-11-21 01:33
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the user_include parameter.
References
Impacted products
Vendor | Product | Version | |
---|---|---|---|
e107 | e107 | * | |
e107 | e107 | 0.7 | |
e107 | e107 | 0.7.0 | |
e107 | e107 | 0.7.1 | |
e107 | e107 | 0.7.2 | |
e107 | e107 | 0.7.3 | |
e107 | e107 | 0.7.4 | |
e107 | e107 | 0.7.5 | |
e107 | e107 | 0.7.6 | |
e107 | e107 | 0.7.7 | |
e107 | e107 | 0.7.8 | |
e107 | e107 | 0.7.9 | |
e107 | e107 | 0.7.10 | |
e107 | e107 | 0.7.11 | |
e107 | e107 | 0.7.12 | |
e107 | e107 | 0.7.13 | |
e107 | e107 | 0.7.14 | |
e107 | e107 | 0.7.15 | |
e107 | e107 | 0.7.16 | |
e107 | e107 | 0.7.17 | |
e107 | e107 | 0.7.18 | |
e107 | e107 | 0.7.19 | |
e107 | e107 | 0.7.20 | |
e107 | e107 | 0.7.21 | |
e107 | e107 | 0.7.22 |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:e107:e107:*:*:*:*:*:*:*:*", matchCriteriaId: "2DC38566-37E2-4BA6-9774-1D728633145D", versionEndIncluding: "0.7.24", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7:*:*:*:*:*:*:*", matchCriteriaId: "70AB914E-D616-45D2-A451-1C247B8B6E4C", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.0:*:*:*:*:*:*:*", matchCriteriaId: "CA5B2762-4A7C-45EE-8A1B-0E7939978321", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.1:*:*:*:*:*:*:*", matchCriteriaId: "CA03C1AC-97EA-47ED-9558-A7CA48420AB2", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.2:*:*:*:*:*:*:*", matchCriteriaId: "32695A82-B042-46B7-9CB4-20F3446E0C9E", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.3:*:*:*:*:*:*:*", matchCriteriaId: "6716A040-0CBE-4402-AB2A-1621B1240B0F", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.4:*:*:*:*:*:*:*", matchCriteriaId: "81627355-AB45-4D47-8DD2-4087E6971EF2", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.5:*:*:*:*:*:*:*", matchCriteriaId: "D2DAAA4F-B893-4914-8538-E68DDA211225", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.6:*:*:*:*:*:*:*", matchCriteriaId: "B649DDC6-EEE6-47E1-A69A-831E5C2DD58C", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.7:*:*:*:*:*:*:*", matchCriteriaId: "2FEEC90E-8640-4786-B014-CAD83EC4F2E6", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.8:*:*:*:*:*:*:*", matchCriteriaId: "E29B9B12-4C94-4A8D-B407-2D288502EFE2", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.9:*:*:*:*:*:*:*", matchCriteriaId: "C5CAADA1-1FBB-4983-A942-FC4490CE8D8E", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.10:*:*:*:*:*:*:*", matchCriteriaId: "B4D7C699-0E92-4D9C-9D8F-87C39A28ACCD", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.11:*:*:*:*:*:*:*", matchCriteriaId: "5C62F8AD-EA30-441E-B97F-EF8DE640DC1B", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.12:*:*:*:*:*:*:*", matchCriteriaId: "F96C30A8-7E56-4806-B8D7-851D75B08738", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.13:*:*:*:*:*:*:*", matchCriteriaId: "F1C22711-AEC4-438F-9B37-64D36B0BDFC9", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.14:*:*:*:*:*:*:*", matchCriteriaId: "5E2AA435-E5FC-4555-B582-5C6FFC99327B", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.15:*:*:*:*:*:*:*", matchCriteriaId: "7A81364B-FB65-4591-ACA3-9D5991F0C30C", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.16:*:*:*:*:*:*:*", matchCriteriaId: "069F5C7C-F549-4B92-A1EA-6310CCF64334", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.17:*:*:*:*:*:*:*", matchCriteriaId: "46EF46A3-7197-4C00-8298-9B938B6EE97B", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.18:*:*:*:*:*:*:*", matchCriteriaId: "B242DBD4-299A-49BC-B399-6C48E04D10DA", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.19:*:*:*:*:*:*:*", matchCriteriaId: "756D821D-63CA-4DCC-8335-679290C197BE", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.20:*:*:*:*:*:*:*", matchCriteriaId: "FFAB4C3E-EE6F-4603-A829-25138966CADF", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.21:*:*:*:*:*:*:*", matchCriteriaId: "56459690-0C9E-4049-A20A-E17152913065", vulnerable: true, }, { criteria: "cpe:2.3:a:e107:e107:0.7.22:*:*:*:*:*:*:*", matchCriteriaId: "E15C0202-89BE-44EE-AD44-B3AF8A41671C", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Cross-site request forgery (CSRF) vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the user_include parameter.", }, { lang: "es", value: "Vulnerabilidad de fasificación de peticiones en sitios cruzados (CSRF) en e107_admin/users_extended.php en e107 anteriores a v0.7.26 permite a atacantes remotos secuestrar la autenticación de los usuarios administradores en peticiones para insertar secuencias de comandos en sitios cruzados (XSS) a través del parámetro user_include.", }, ], id: "CVE-2011-4947", lastModified: "2024-11-21T01:33:20.833", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.8, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], }, published: "2012-08-31T22:55:01.263", references: [ { source: "secalert@redhat.com", url: "http://e107.org/svn_changelog.php?version=0.7.26", }, { source: "secalert@redhat.com", url: "http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/users_extended.php?r1=12225&r2=12306", }, { source: "secalert@redhat.com", url: "http://www.openwall.com/lists/oss-security/2012/03/28/4", }, { source: "secalert@redhat.com", url: "http://www.openwall.com/lists/oss-security/2012/03/29/3", }, { source: "secalert@redhat.com", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/68062", }, { source: "secalert@redhat.com", url: "https://www.htbridge.com/advisory/multiple_vulnerabilities_in_e107_1.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://e107.org/svn_changelog.php?version=0.7.26", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/users_extended.php?r1=12225&r2=12306", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.openwall.com/lists/oss-security/2012/03/28/4", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.openwall.com/lists/oss-security/2012/03/29/3", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/68062", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://www.htbridge.com/advisory/multiple_vulnerabilities_in_e107_1.html", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-352", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.