CVE-2015-6545

Published: Sep 3, 2015Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a saveWorkerPeek action.

Affected (1)

Products: Webgroupmedia: Cerb

Webgroupmedia

1 product

Cerb

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Webgroupmedia Cerb	Up to 7.0.3

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (12)

http://packetstormsecurity.com/files/133404/Cerb-7.0.3-Cross-Site-Request-Forgery.html

Source: cve@mitre.org

http://wiki.cerbweb.com/7.0#7.0.4

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/archive/1/536376/100/0/threaded

Source: cve@mitre.org

https://github.com/wgm/cerb/commit/12de87ff9961a4f3ad2946c8f47dd0c260607144

Source: cve@mitre.org

https://www.exploit-db.com/exploits/38074/

Source: cve@mitre.org

https://www.htbridge.com/advisory/HTB23269

Source: cve@mitre.org

Exploit

http://packetstormsecurity.com/files/133404/Cerb-7.0.3-Cross-Site-Request-Forgery.html