CVE-2014-9459

EPSS 0.18%
Veröffentlicht 02.01.2015 20:59:19
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of administrators for requests that add users to the administrator group via the id parameter in an admin action.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

E107 ≫ E107 Version2.0 Updatealpha2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.18%	0.362

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

http://packetstormsecurity.com/files/129751/e107-2.0-Alpha2-Cross-Site-Request-Forgery.html

http://seclists.org/fulldisclosure/2014/Dec/124

http://sroesemann.blogspot.de/2014/12/sroeadv-2014-04.html

https://github.com/e107inc/e107/commit/9249f892b1e635979db2a830393694fb73531080

https://nvd.nist.gov/vuln/detail/CVE-2014-9459

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-9459

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-9459

EUVD