CVE-2014-5100

Name of the Vulnerable Software and Affected Versions Omeka versions prior to 2.2.1

Description The issue allows remote attackers to hijack the authentication of administrators for requests, including adding a new super user account via a request to "admin/users/add", inserting cross-site scripting (XSS) sequences via the api key label parameter to "admin/users/api-keys/1", or disabling file validation via a request to "admin/settings/edit-security".

Recommendations For Omeka versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue.