CVE-2018-7634
Summary
| CVE | CVE-2018-7634 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-03-01 23:29:00 UTC |
| Updated | 2018-03-22 13:59:00 UTC |
| Description | An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse the functionality by attackers. By making a CSRF attack, an attacker could make a victim change his registered e-mail address on the application, leading to account takeover. |
Risk And Classification
Problem Types: CWE-352
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Git - Tuleap | CONFIRM | tuleap.net | Issue Tracking, Patch, Vendor Advisory |
| Merge 'gerrit #10714' into stable/master · Enalean/tuleap@0843c04 · GitHub | CONFIRM | github.com | Patch |
| Mustafa iran na Twitterze: "I've got my first CVE. Here is the POC video. Tuleap mail change CSRF vulnerability leads to account takeover https://t.co/pgDm08PABq @Mustafaran aracılığıyla Thanks god for public disclosure concept :)" | MISC | twitter.com | Exploit, Third Party Advisory |
| Tuleap mail change CSRF vulnerability leads to account takeover | mi | MISC | mustafairan.wordpress.com | Exploit, Patch, Third Party Advisory |
| Account takeover due to a missing CSRF protection on email addre - request #11217 - Requests - Tuleap | CONFIRM | tuleap.net | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.