CVE-2010-5084 - CVE House

Status published Medium CVE-2010-5084

The cross-site request forgery (CSRF) protection mechanism in e107 before...

6 CVSS

Vulnerability Description

The cross-site request forgery (CSRF) protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrator account, which allows remote attackers to hijack the authentication of administrators for requests that add new users via e107_admin/users.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2010-5084

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from e107

View All →

CVE-2025-11941

e107 CMS Avatar image.php path traversal

Medium 5.3

CVE-2022-50916

e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override

High 8.7

CVE-2022-50907

e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE

High 8.6

CVE-2022-50906

e107 CMS v3.2.1 - Admin Upload Restriction Bypass + Stored XSS

Medium 4.8

CVE-2022-50905

e107 CMS v3.2.1 - Reflected XSS via Comment Flow

Medium 6.1

Affected Vendor

e107

View all reports →

Affected Software

e107

Vulnerable Versions:

0, 0.6_10, 0.6_11, 0.6_12, 0.6_13, 0.6_14, 0.6_15, 0.6_15a, 0.7, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.7.8, 0.7.9, 0.7.10, 0.7.11, 0.7.12, 0.7.13, 0.7.14, 0.7.15, 0.7.16, 0.7.17, 0.7.18, 0.7.19, 0.7.20, 0.7.21, 0.545, 0.547, 0.548, 0.549, 0.551, 0.552, 0.553, 0.554, 0.555, 0.600, 0.601, 0.602, 0.603, 0.604, 0.605, 0.606, 0.607, 0.608, 0.609, 0.610, 0.611, 0.612, 0.613, 0.614, 0.615, 0.615a, 0.616, 0.617, 0.6171, 0.6172, 0.6173, 0.6174, 0.6175

Timeline

Official Publish: February 14th, 2012

Last Modified: September 16th, 2024

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.