Описание
Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action.
Ссылки
- Vendor Advisory
- Exploit
- Vendor Advisory
- Vendor Advisory
- Exploit
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:simple_machines:simple_machines_forum:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.0.7:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.0.11:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.0.12:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.1.5:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.1.6:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc1:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc2:*:*:*:*:*:*:*
cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc3:*:*:*:*:*:*:*
EPSS
Процентиль: 83%
0.01932
Низкий
6.8 Medium
CVSS2
Дефекты
CWE-352
Связанные уязвимости
github
больше 3 лет назад
Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action.
EPSS
Процентиль: 83%
0.01932
Низкий
6.8 Medium
CVSS2
Дефекты
CWE-352