CVE-2015-10081 : A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified

A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.0b2.9a is able to address this issue. The patch is named a739f680a1623d22f52ff1371e86ca472e63756f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221495.

Published 2023-02-20 17:15:11

Updated 2024-05-17 01:03:06

Source VulDB

View at NVD, CVE.org

Vulnerability category: Cross-site request forgery (CSRF)

Products affected by CVE-2015-10081

Submitbymailplugin Project » Submitbymailplugin » Version: 1.0b2.9
cpe:2.3:a:submitbymailplugin_project:submitbymailplugin:1.0b2.9:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-10081

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 50 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-10081

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	VulDB
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4	VulDB
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4	VulDB	2024-02-29
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2015-10081

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Assigned by: cna@vuldb.com (Primary)

References for CVE-2015-10081

https://vuldb.com/?id.221495

Login required
Third Party Advisory
https://vuldb.com/?ctiid.221495

Login required
Permissions Required;Third Party Advisory
https://github.com/arnoldle/phplist-plugin-submitByMailPlugin/commit/a739f680a1623d22f52ff1371e86ca472e63756f

Added csrf prevention to edit_list.php · arnoldle/phplist-plugin-submitByMailPlugin@a739f68 · GitHub
Patch

Jump to

Vulnerability Details : CVE-2015-10081

Products affected by CVE-2015-10081

Exploit prediction scoring system (EPSS) score for CVE-2015-10081

CVSS scores for CVE-2015-10081

CWE ids for CVE-2015-10081

References for CVE-2015-10081