SilverStripe Unspecified Cross Site Request Forgery Vulnerability
BID:44768
Info
SilverStripe Unspecified Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 44768 |
| Class: | Design Error |
| CVE: |
CVE-2010-5088 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 10 2010 12:00AM |
| Updated: | Mar 19 2015 07:35AM |
| Credit: | Russ McRee |
| Vulnerable: |
SilverStripe SilverStripe 2.4.2 |
| Not Vulnerable: |
SilverStripe SilverStripe 2.4.3-rc1 SilverStripe SilverStripe 2.3.9-rc1 |
Discussion
SilverStripe Unspecified Cross Site Request Forgery Vulnerability
SilverStripe is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible.
SilverStripe 2.4.2 is vulnerable; other versions may also be affected.
SilverStripe is prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible.
SilverStripe 2.4.2 is vulnerable; other versions may also be affected.
Exploit / POC
SilverStripe Unspecified Cross Site Request Forgery Vulnerability
To exploit this issue, an attacker must entice a user into visiting a malicious site.
To exploit this issue, an attacker must entice a user into visiting a malicious site.
Solution / Fix
SilverStripe Unspecified Cross Site Request Forgery Vulnerability
Solution:
Vendor updates are available. Please contact the vendor for more information.
Solution:
Vendor updates are available. Please contact the vendor for more information.
References
SilverStripe Unspecified Cross Site Request Forgery Vulnerability
References:
References:
- SilverStripe Homepage (SilverStripe)
- SilverStripe Release Announcements SilverStripe 2.4.3-rc1 (Ingo Schommer)
- SilverStripe Release Announcements SilverStripe 2.3.9-rc1 (Ingo Schommer)