CVE-2010-5085

Опубликовано: 14 фев. 2012

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Multiple cross-site request forgery (CSRF) vulnerabilities in admin/update_user in Hulihan Amethyst 0.1.5, and possibly earlier, allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrative password or (2) change the site's configuration.

Ссылки

http://dev.hulihanapplications.com/issues/show/208
Exploit
http://marc.info/?l=bugtraq&m=128104795219200&w=2
Exploit
http://secunia.com/advisories/40874
Vendor Advisory
http://www.htbridge.ch/advisory/xsrf_csrf_in_amethyst.html
Exploit
http://www.osvdb.org/67043
http://www.vupen.com/english/advisories/2010/2022
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/60947
http://dev.hulihanapplications.com/issues/show/208
Exploit
http://marc.info/?l=bugtraq&m=128104795219200&w=2
Exploit
http://secunia.com/advisories/40874
Vendor Advisory
http://www.htbridge.ch/advisory/xsrf_csrf_in_amethyst.html
Exploit
http://www.osvdb.org/67043
http://www.vupen.com/english/advisories/2010/2022
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/60947

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:hulihanapplications:amethyst:0.1.5:*:*:*:*:*:*:*

EPSS

Процентиль: 48%

0.00253

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-9g53-m8g7-vm8p

github

больше 3 лет назад