CVE-2013-7376

Published: May 14, 2014Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remote attackers to hijack the authentication of administrators, as demonstrated by requests that conduct directory traversal attacks via the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin, a different vulnerability than CVE-2013-3514.

Affected (1)

Products: Openx: Openx

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openx Openx	Version 2.8.10

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (6)

http://osvdb.org/94778

Source: cve@mitre.org

http://seclists.org/bugtraq/2013/Jul/27

Source: cve@mitre.org

Exploit

https://www.htbridge.com/advisory/HTB23155

Source: cve@mitre.org

Exploit

http://osvdb.org/94778

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/bugtraq/2013/Jul/27

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://www.htbridge.com/advisory/HTB23155

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.