Multiple MilkyStep Products CVE-2015-2954 Cross Site Request Forgery Vulnerability

Bugtraq ID:	75072
Class:	Input Validation Error
CVE:	CVE-2015-2954
Remote:	Yes
Local:	No
Published:	Jun 09 2015 12:00AM
Updated:	Jun 09 2015 12:00AM
Credit:	Kusano Kazuhiko
Vulnerable:	Igreks Inc MilkyStep Professional OEM 1.82 Igreks Inc MilkyStep Professional 1.82 Igreks Inc MilkyStep Light 0.94
Not Vulnerable:

Multiple MilkyStep Products CVE-2015-2954 Cross Site Request Forgery Vulnerability

Multiple MilkyStep products are prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

The following products are vulnerable:

MilkyStep Light 0.94 and prior
MilkyStep Professional 1.82 and prior
MilkyStep Professional OEM 1.82 and prior

Multiple MilkyStep Products CVE-2015-2954 Cross Site Request Forgery Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Multiple MilkyStep Products CVE-2015-2954 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple MilkyStep Products CVE-2015-2954 Cross Site Request Forgery Vulnerability

References:

• MilkyStep Home Page (Igreks Inc.)
  
• JVN#12241436 MilkyStep vulnerable to cross-site request forgery (JPCERT)