Cross-Site Request Forgery in e107 by e107 Inc. Allows User Deletion
CVE-2018-11127

6.5MEDIUM

Key Information:

Vendor

E107

Status
E107
Vendor
CVE Published:
15 May 2018

What is CVE-2018-11127?

The e107 CMS version 2.1.7 is vulnerable to Cross-Site Request Forgery (CSRF), allowing authorized attackers to delete arbitrary users without their consent. This security flaw can jeopardize the integrity of user accounts and overall site security. Implement proper protections against CSRF attacks to safeguard your e107 installation.

References

https://github.com/e107inc/e107/issues/3128
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.