Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build...
Vulnerability Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build 7907 and 7906) and SkaDate Lite 2.0 (build 7651) allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks or possibly have other unspecified impact via the (1) label parameter to admin/users/roles/, (2) lang[1][base][questions_account_type_5615100a931845eca8da20cfdf7327e0] in an AddAccountType action or (3) qst_name parameter in an addQuestion action to admin/questions/ajax-responder/, or (4) form_name or (5) restrictedUsername parameter to admin/restricted-usernames.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-9101
Credits & Attribution
No credits recorded in the NVD database.
References
- http://packetstormsecurity.com/files/127652/Oxwall-1.7.0-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
- http://www.exploit-db.com/exploits/34190
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5195.php
- http://www.securityfocus.com/bid/68971
- http://osvdb.org/show/osvdb/109622
- http://osvdb.org/show/osvdb/109623
- http://packetstormsecurity.com/files/127690/SkaDate-Lite-2.0-CSRF-Cross-Site-Scripting.html
- http://osvdb.org/show/osvdb/109624
- http://osvdb.org/show/osvdb/109625
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5197.php
Affected Vendor
skalfa
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.