CVE-2013-2713
medium
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8
Description
Cross-site request forgery (CSRF) vulnerability in users_maint.html in KrisonAV CMS before 3.0.2 allows remote attackers to hijack the authentication of administrators for requests that create user accounts via a crafted request.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — http://www.krisonav.com/index.php?module=articles_show&articles_id=release-notes
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| krisonav | krisonav | {"endIncluding":"3.0.1"} | |
| krisonav | krisonav | 0.9.3 | |
| krisonav | krisonav | 0.9.4 | |
| krisonav | krisonav | 0.9.5 | |
| krisonav | krisonav | 0.9.6 | |
| krisonav | krisonav | 0.9.7 | |
| krisonav | krisonav | 1.0.0 | |
| krisonav | krisonav | 1.0.1 | |
| krisonav | krisonav | 1.0.2 | |
| krisonav | krisonav | 1.1.35 | |
| krisonav | krisonav | 2.0.1 | |
| krisonav | krisonav | 2.1.3 | |
| krisonav | krisonav | 2.1.5 | |
| krisonav | krisonav | 2.1.6 | |
| krisonav | krisonav | 3.0.0 | |
References
- http://archives.neohapsis.com/archives/bugtraq/2013-04/0184.html
- http://www.exploit-db.com/exploits/24965
- http://www.krisonav.com/index.php?module=articles_show&articles_id=release-notes
- http://www.securityfocus.com/bid/59273
- https://www.htbridge.com/advisory/HTB23150
- http://archives.neohapsis.com/archives/bugtraq/2013-04/0184.html
- http://www.exploit-db.com/exploits/24965
- http://www.krisonav.com/index.php?module=articles_show&articles_id=release-notes
- http://www.securityfocus.com/bid/59273
- https://www.htbridge.com/advisory/HTB23150
CWEs
CWE-352
Verify integrity in audit chain (admin only). AS-IS.