PRIOn knowledge basePRION:CVE-2007-3255Cross site request forgery (csrf)
7.7 High
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
75.5%
Multiple cross-site request forgery (CSRF) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to execute commands as arbitrary users via (1) a saved Workflow name or (2) the Content-Type HTTP header. NOTE: item 2 also affects the same version numbers of Xythos Digital Locker (XDL). One or both vectors might also affect Xythos WebFile Server.
| CPE | Name | Operator | Version |
|---|---|---|---|
| enterprise_document_manager | le | 6.0.46.0 | |
| enterprise_document_manager | le | 5.0.25.7 |
References
osvdb.org/37615
osvdb.org/37616
secunia.com/advisories/25783
securityreason.com/securityalert/2845
securitytracker.com/id?1018291
securitytracker.com/id?1018292
www.securityfocus.com/archive/1/472275/100/0/threaded
www.securityfocus.com/bid/24521
www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-004.txt
exchange.xforce.ibmcloud.com/vulnerabilities/35084
7.7 High
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
75.5%