CVE-2010-5084 : 상세 정보

CVE-2010-5084

0.12%V4
2012-02-14
20h00 +00:00
Cross-Site Request Forgery - CSRF
A01-Broken Access Control
Network
2024-09-16
21h57 +00:00
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
알림 관리

CVE 설명

The cross-site request forgery (CSRF) protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrator account, which allows remote attackers to hijack the authentication of administrators for requests that add new users via e107_admin/users.php.

CVE 정보

관련 약점

CWE-ID 약점 이름 출처
CWE-352 Cross-Site Request Forgery
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

메트릭

메트릭 점수 심각도 CVSS 벡터 출처
V2 6 AV:N/AC:M/Au:S/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS는 취약점이 악용될 가능성을 예측하는 점수 모델입니다.

EPSS 점수

EPSS 모델은 0과 1(0~100%) 사이의 확률 점수를 생성합니다. 점수가 높을수록 취약점이 악용될 가능성이 높습니다.

EPSS 백분위수

백분위수는 EPSS 점수에 따라 CVE의 순위를 매기는 데 사용됩니다. 예를 들어 EPSS 점수 기준 95번째 백분위수의 CVE는 다른 CVE의 95%보다 악용될 가능성이 높습니다.

언급된 제품

구성 0

E107>>E107 >> Version 까지 (포함) 0.7.22

E107>>E107 >> Version 0.6_10

E107>>E107 >> Version 0.6_11

E107>>E107 >> Version 0.6_12

E107>>E107 >> Version 0.6_13

E107>>E107 >> Version 0.6_14

E107>>E107 >> Version 0.6_15

E107>>E107 >> Version 0.6_15a

E107>>E107 >> Version 0.7

E107>>E107 >> Version 0.7.0

E107>>E107 >> Version 0.7.1

E107>>E107 >> Version 0.7.2

E107>>E107 >> Version 0.7.3

E107>>E107 >> Version 0.7.4

E107>>E107 >> Version 0.7.5

E107>>E107 >> Version 0.7.6

E107>>E107 >> Version 0.7.7

E107>>E107 >> Version 0.7.8

E107>>E107 >> Version 0.7.9

E107>>E107 >> Version 0.7.10

E107>>E107 >> Version 0.7.11

E107>>E107 >> Version 0.7.12

E107>>E107 >> Version 0.7.13

E107>>E107 >> Version 0.7.14

E107>>E107 >> Version 0.7.15

E107>>E107 >> Version 0.7.16

E107>>E107 >> Version 0.7.17

E107>>E107 >> Version 0.7.18

E107>>E107 >> Version 0.7.19

E107>>E107 >> Version 0.7.20

E107>>E107 >> Version 0.7.21

E107>>E107 >> Version 0.545

E107>>E107 >> Version 0.547

E107>>E107 >> Version 0.548

E107>>E107 >> Version 0.549

E107>>E107 >> Version 0.551

E107>>E107 >> Version 0.552

E107>>E107 >> Version 0.553

E107>>E107 >> Version 0.554

E107>>E107 >> Version 0.554

E107>>E107 >> Version 0.555

E107>>E107 >> Version 0.600

E107>>E107 >> Version 0.601

E107>>E107 >> Version 0.602

E107>>E107 >> Version 0.603

E107>>E107 >> Version 0.604

E107>>E107 >> Version 0.605

E107>>E107 >> Version 0.606

E107>>E107 >> Version 0.607

E107>>E107 >> Version 0.608

E107>>E107 >> Version 0.609

E107>>E107 >> Version 0.610

E107>>E107 >> Version 0.611

E107>>E107 >> Version 0.612

E107>>E107 >> Version 0.613

E107>>E107 >> Version 0.614

E107>>E107 >> Version 0.615

E107>>E107 >> Version 0.615a

E107>>E107 >> Version 0.616

E107>>E107 >> Version 0.617

E107>>E107 >> Version 0.6171

E107>>E107 >> Version 0.6172

E107>>E107 >> Version 0.6173

E107>>E107 >> Version 0.6174

E107>>E107 >> Version 0.6175

참고 자료

http://www.securitytracker.com/id?1024351
Tags : vdb-entry, x_refsource_SECTRACK
http://secunia.com/advisories/41034
Tags : third-party-advisory, x_refsource_SECUNIA