CVE-2015-0905 : Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers

Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users.

Published 2015-04-08 01:59:00

Updated 2025-04-12 10:46:41

Source JPCERT/CC

View at NVD, CVE.org

Vulnerability category: Cross-site request forgery (CSRF)

Products affected by CVE-2015-0905

Bblog Project » Bblog
cpe:2.3:a:bblog_project:bblog:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 35 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Assigned by: nvd@nist.gov (Primary)

http://sourceforge.net/projects/bblog/

bBlog download | SourceForge.net
http://www.securitytracker.com/id/1032041

bBlog Lets Remote Users Conduct Cross-Site Request Forgery Attacks - SecurityTracker
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000047

JVNDB-2015-000047 - JVN iPedia - 脆弱性対策情報データベース
Vendor Advisory
http://jvn.jp/en/jp/JVN71903938/index.html

JVN#71903938: bBlog vulnerable to cross-site request forgery
Vendor Advisory

Jump to