Multiple cross-site request forgery (CSRF) vulnerabilities in Xythos Enterprise Document...
Vulnerability Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to execute commands as arbitrary users via (1) a saved Workflow name or (2) the Content-Type HTTP header. NOTE: item 2 also affects the same version numbers of Xythos Digital Locker (XDL). One or both vectors might also affect Xythos WebFile Server.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-3255
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/archive/1/472275/100/0/threaded
- http://www.securityfocus.com/bid/24521
- http://osvdb.org/37616
- http://secunia.com/advisories/25783
- http://securitytracker.com/id?1018292
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35084
- http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-004.txt
- http://securityreason.com/securityalert/2845
- http://securitytracker.com/id?1018291
- http://osvdb.org/37615
Affected Vendor
xythos
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.