CVE-2011-5011

Publicada em 25 dez 2011 · Atualizada em 07 ago 2024

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 3.3%

Multiple cross-site request forgery (CSRF) vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that (1) set a New user to Admin via the cID parameter to a statusconfirm action in admin/customers.php and (2) grant permissions to users via the cID parameter to a save action in admin/accounting.php.

Produtos afetados

n/a · n/a

Referências

http://dishix.blogspot.com/2011/11/exploiting-xtcommerce-v304-sp21-cross.html http://dishix.blogspot.com/p/xtcommerce-v304-sp21-cross-site-request_29.html http://osvdb.org/77498 http://secunia.com/advisories/47032 https://exchange.xforce.ibmcloud.com/vulnerabilities/71642