xt:Commerce Cross Site Request Forgery Vulnerability

Bugtraq ID:	50911
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 05 2011 12:00AM
Updated:	Dec 05 2011 12:00AM
Credit:	Dishix
Vulnerable:	xt:Commerce xt:Commerce 3.04 Sp2.1
Not Vulnerable:

xt:Commerce Cross Site Request Forgery Vulnerability

xt:Commerce is prone to a cross-site request-forgery vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

xt:Commerce 3.0.4 SP2.1 is vulnerable; other versions may also be affected.

xt:Commerce Cross Site Request Forgery Vulnerability

To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI or visit a malicious website.

xt:Commerce Cross Site Request Forgery Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

xt:Commerce Cross Site Request Forgery Vulnerability

References:

• xt:Commerce Homepage (xt:Commerce GmbH)
  
• Exploiting xt:Commerce v3.04 SP2.1 Cross Site Request Forgery (CSRF) (dishix)