Lucene search

MitreCVE-2015-1424

HistoryJan 29, 2015 - 3:59 p.m.

CVE-2015-1424

2015-01-2915:59:03

CWE-352

mitre

web.nvd.nist.gov

cve-2015-1424

cross-site request forgery

csrf

gecko cms

remote attackers

authentication hijacking

administrator user

newuser request

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.3

Confidence

Low

EPSS

0.01

Percentile

83.7%

JSON

Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.

Affected configurations

Nvd

Node

jakwebgecko_cmsMatch2.2

jakwebgecko_cmsMatch2.3

VendorProductVersionCPE
jakwebgecko_cms2.2cpe:2.3:a:jakweb:gecko_cms:2.2:*:*:*:*:*:*:*
jakwebgecko_cms2.3cpe:2.3:a:jakweb:gecko_cms:2.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
jakweb	gecko_cms	2.2	cpe:2.3:a:jakweb:gecko_cms:2.2:::::::*
jakweb	gecko_cms	2.3	cpe:2.3:a:jakweb:gecko_cms:2.3:::::::*

References

osvdb.org/show/osvdb/116966

packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html

www.exploit-db.com/exploits/35767

www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5222.php

exchange.xforce.ibmcloud.com/vulnerabilities/99974

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.3

Confidence

Low

EPSS

0.01

Percentile

83.7%

JSON

Related for CVE-2015-1424