CVE-2015-6966

Опубликовано: 16 сент. 2015

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) create a post via a new_simple action to admin.php or (2) conduct cross-site scripting (XSS) attacks via the content parameter in a new_simple action to admin.php.

Ссылки

http://blog.curesec.com/article/blog/NibbleBlog-403-CSRF-46.html
Exploit
http://blog.nibbleblog.com/post/nibbleblog-v4-0-5/
Patch
Vendor Advisory
http://seclists.org/fulldisclosure/2015/Sep/4
Exploit
http://blog.curesec.com/article/blog/NibbleBlog-403-CSRF-46.html
Exploit
http://blog.nibbleblog.com/post/nibbleblog-v4-0-5/
Patch
Vendor Advisory
http://seclists.org/fulldisclosure/2015/Sep/4
Exploit

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:nibbleblog:nibbleblog:*:*:*:*:*:*:*:*

Версия до 4.0.4 (включая)

EPSS

Процентиль: 34%

0.00132

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-23c4-2wcp-ccr7

github

около 3 лет назад