Lucene search
HistoryJan 29, 2015 - 3:59 p.m.
CVE-2015-1424
cve-2015-1424
cross-site request forgery
csrf
gecko cms
remote attackers
authentication hijacking
administrator user
newuser request
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
7.3 High
AI Score
Confidence
Low
0.01 Low
EPSS
Percentile
83.7%
Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.
Affected configurations
Node
jakwebgecko_cmsMatch2.2
ORjakwebgecko_cmsMatch2.3
| CPE | Name | Operator | Version |
|---|---|---|---|
| jakweb:gecko_cms | jakweb gecko cms | eq | 2.2 |
| jakweb:gecko_cms | jakweb gecko cms | eq | 2.3 |
Related
cvelist
cvelist
CVE-2015-1424
2015-01-29 15:00:00
prion
prion
Cross site request forgery (csrf)
2015-01-29 15:59:00
nvd
nvd
CVE-2015-1424
2015-01-29 15:59:03
zeroscience
zeroscience
Gecko CMS 2.3 Multiple Vulnerabilities
2015-01-12 00:00:00
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
7.3 High
AI Score
Confidence
Low
0.01 Low
EPSS
Percentile
83.7%
Related for CVE-2015-1424