CVE-2013-4725

🗓️ 06 Jun 2014 14:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 46 Views🌐 WEB

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session

Reporter	Title	Published	Views	Family All 7
zdt	CM3 AcoraCMS XSS / CSRF / Redirection / Disclosure Vulnerabilities	27 Aug 201300:00	–	zdt
Cvelist	CVE-2013-4725	6 Jun 201414:00	–	cvelist
EUVD	EUVD-2013-4576	7 Oct 202500:30	–	euvd
NVD	CVE-2013-4725	6 Jun 201414:55	–	nvd
OpenVAS	Acora CMS Multiple Vulnerabilities (Apr 2014) - Active Check	29 Apr 201400:00	–	openvas
Packet Storm	CM3 AcoraCMS XSS / CSRF / Redirection / Disclosure	26 Aug 201300:00	–	packetstorm
Prion	Session fixation	6 Jun 201414:55	–	prion

NVD

Node

ddsn cm3_acora_content_management_systemMatch5.5.0/1b-p1

ddsn cm3_acora_content_management_systemMatch5.5.7/12b

ddsn cm3_acora_content_management_systemMatch6.0.2/1a

ddsn cm3_acora_content_management_systemMatch6.0.6/1a

Source	Link
osvdb	www.osvdb.org/96664
digitalsec	www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt

Parameter	Position	Path	Description	CWE
username	query param	AcoraCMS/Admin/login/default.asp	Reflected Cross Site Scripting via default.asp parameters (username, url)	CWE-200
url	query param	AcoraCMS/Admin/login/default.asp	Reflected Cross Site Scripting via default.asp parameters (username, url)	CWE-200
m	query param	AcoraCMS/track.aspx	URL redirect vulnerability via l parameter allowing redirection to external sites	CWE-200
l	query param	AcoraCMS/track.aspx	URL redirect vulnerability via l parameter allowing redirection to external sites	CWE-200
__VIEWSTATE	request body	AcoraCMS/Admin/top.aspx	Information leakage via __VIEWSTATE in form data	CWE-200

16 Jun 2026 23:57Current

6.8Medium risk

Vulners AI Score6.8

CVSS 25

EPSS0.01173

CWE-200