PT-2011-5166 · Xt:Commerce · Xt:Commerce
CVE-2011-5011
·
Publicado
2011-12-25
·
Atualizado
2024-03-19
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
xt:Commerce versions 3.0.4 SP2.1 and earlier
Description
The issue allows remote attackers to hijack the authentication of admins for specific requests. This can be achieved through cross-site request forgery (CSRF) vulnerabilities. The vulnerabilities are exploited by manipulating the
cID parameter in two scenarios:- Setting a new user to admin via the
statusconfirmaction inadmin/customers.php. - Granting permissions to users via the
saveaction inadmin/accounting.php.
Recommendations
For xt:Commerce versions 3.0.4 SP2.1 and earlier, consider disabling the
statusconfirm and save actions in admin/customers.php and admin/accounting.php respectively until a patch is available. Restrict access to these modules to minimize the risk of exploitation. Avoid using the cID parameter in the affected API endpoints until the issue is resolved.Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Xt:Commerce