Lucene search

[email protected]CVE-2010-0711

HistoryOct 03, 2022 - 4:21 p.m.

CVE-2010-0711

2022-10-0316:21:10

CWE-352

[email protected]

web.nvd.nist.gov

cve-2010-0711

csrf vulnerability

aspcode cms

authentication hijacking

remote attack

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.5 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

79.4%

JSON

Cross-site request forgery (CSRF) vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attackers to hijack the authentication of an administrator for requests that (1) delete users via the delete action in the ma2 parameter or (2) create administrators via the update action in the ma2 parameter.

Affected configurations

NVD

Node

aspcodecmsaspcode_cmsMatch1.5.8

aspcodecmsaspcode_cmsMatch2.0.0

CPENameOperatorVersion
aspcodecms:aspcode_cmsaspcodecms aspcode cmseq1.5.8
aspcodecms:aspcode_cmsaspcodecms aspcode cmseq2.0.0

CPE	Name	Operator	Version
aspcodecms:aspcode_cms	aspcodecms aspcode cms	eq	1.5.8
aspcodecms:aspcode_cms	aspcodecms aspcode cms	eq	2.0.0

References

osvdb.org/62357

packetstormsecurity.org/1002-exploits/aspcodecms-xssxsrf.txt

secunia.com/advisories/38596

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.5 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

79.4%

JSON

Related for CVE-2010-0711

prion1 cvelist1 nvd1