CVE-2010-4729

2022-10-0316:21:03

CWE-352

[email protected]

web.nvd.nist.gov

cve-2010-4729

zikula

security vulnerability

csrf

authid protection mechanism

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.7%

JSON

Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword form and (2) mailpasswd processing, which makes it easier for remote attackers to generate a flood of password requests and possibly conduct cross-site request forgery (CSRF) attacks via multiple form submissions.

Affected configurations

NVD

Node

zikulazikula_application_frameworkRange≤1.2.2

zikulazikula_application_frameworkMatch1.1.2

zikulazikula_application_frameworkMatch1.2.1

CPENameOperatorVersion
zikula:zikula_application_frameworkzikula zikula application frameworkle1.2.2
zikula:zikula_application_frameworkzikula zikula application frameworkeq1.1.2
zikula:zikula_application_frameworkzikula zikula application frameworkeq1.2.1

CPE	Name	Operator	Version
zikula:zikula_application_framework	zikula zikula application framework	le	1.2.2
zikula:zikula_application_framework	zikula zikula application framework	eq	1.1.2
zikula:zikula_application_framework	zikula zikula application framework	eq	1.2.1