VulnerabilityModified
CVE-2014-9459
Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of administrators for requests that add users to the administrator group via…
MEDIUM 6.8EPSS 1.10%
Does this matter?
Lower severity and a low EPSS score (1.10%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of administrators for requests that add users to the administrator group via the id parameter in an admin action.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.10% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- e107/e107
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/129751/e107-2.0-Alpha2-Cross-Site-Request-Forgery.html
- http://seclists.org/fulldisclosure/2014/Dec/124
- http://sroesemann.blogspot.de/2014/12/sroeadv-2014-04.html
- https://github.com/e107inc/e107/commit/9249f892b1e635979db2a830393694fb73531080
- http://packetstormsecurity.com/files/129751/e107-2.0-Alpha2-Cross-Site-Request-Forgery.html
- http://seclists.org/fulldisclosure/2014/Dec/124
- http://sroesemann.blogspot.de/2014/12/sroeadv-2014-04.html
- https://github.com/e107inc/e107/commit/9249f892b1e635979db2a830393694fb73531080
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.