PT-2015-3471
CVE-2010-5315
·
تاريخ النشر
2015-01-03
·
تاريخ التحديث
2015-01-05
الوصف من
CVSS 2.0
6.8
متوسطةالمقاييسAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
BEdita versions prior to 3.1
Description
The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests, including creating categories via a data array to "news/saveCategories" or modifying credentials via a data array to "admin/saveUser".
Recommendations
For versions prior to 3.1, update to version 3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "news/saveCategories" and "admin/saveUser" API endpoints to minimize the risk of exploitation. Avoid using these endpoints with administrator authentication until the issue is resolved.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾