CVE-2014-6046

Published: Aug 28, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CSRF tokens or that (2) delete open questions, (3) activate users, (4) publish FAQs, (5) add or delete Glossary, (6) add or delete FAQ news, or (7) add or delete comments or add votes by leveraging lack of a CSRF token.

Affected (1)

Products: Phpmyfaq: Phpmyfaq

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Phpmyfaq Phpmyfaq	Before 2.8.13

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (4)

http://techdefencelabs.com/security-advisories.html

Source: cve@mitre.org

Third Party Advisory

https://www.phpmyfaq.de/security/advisory-2014-09-16

Source: cve@mitre.org

Vendor Advisory

http://techdefencelabs.com/security-advisories.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.phpmyfaq.de/security/advisory-2014-09-16

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.