Vulnerability Details : CVE-2014-9459
Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of administrators for requests that add users to the administrator group via the id parameter in an admin action.
Vulnerability category: Cross-site request forgery (CSRF)
Products affected by CVE-2014-9459
- cpe:2.3:a:e107:e107:2.0:alpha2:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-9459
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 52 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-9459
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2014-9459
-
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-9459
-
https://github.com/e107inc/e107/commit/9249f892b1e635979db2a830393694fb73531080
Added additional check prior to administrator status change. · e107inc/e107@9249f89 · GitHub
-
http://seclists.org/fulldisclosure/2014/Dec/124
Full Disclosure: CSRF vulnerability in CMS e107 v.2 alpha2
-
http://packetstormsecurity.com/files/129751/e107-2.0-Alpha2-Cross-Site-Request-Forgery.html
e107 2.0 Alpha2 Cross Site Request Forgery ≈ Packet Storm
-
http://sroesemann.blogspot.de/2014/12/sroeadv-2014-04.html
travel-free
Jump to