OpenX CVE-2013-5954 Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	66251
Class:	Input Validation Error
CVE:	CVE-2013-5954
Remote:	Yes
Local:	No
Published:	Mar 15 2014 12:00AM
Updated:	May 16 2014 12:52AM
Credit:	Mahmoud Ghorbanzadeh
Vulnerable:	OpenX OpenX 2.8.8 OpenX OpenX 2.8.2 OpenX OpenX 2.8.1 OpenX OpenX 2.8.7 OpenX OpenX 2.8.6 OpenX OpenX 2.8.5 OpenX OpenX 2.8.4 OpenX OpenX 2.8.3 OpenX OpenX 2.8.0
Not Vulnerable:

OpenX CVE-2013-5954 Multiple Cross Site Request Forgery Vulnerabilities

OpenX is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.

OpenX 2.8.11 and prior versions are vulnerable.

OpenX CVE-2013-5954 Multiple Cross Site Request Forgery Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI or visit a malicious website.

The following example Proof of Concept is available:

• /data/vulnerabilities/exploits/66251.txt

OpenX CVE-2013-5954 Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenX CVE-2013-5954 Multiple Cross Site Request Forgery Vulnerabilities

References:

• OpenX Homepage (OpenX)