Cross-Site Request Forgery Vulnerability in e107 by e107.org
CVE-2018-15901

8.8HIGH

Key Information:

Vendor

E107

Status
E107
Vendor
CVE Published:
28 August 2018

What is CVE-2018-15901?

The e107 content management system version 2.1.8 is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability found in the 'usersettings.php' file. This security flaw allows attackers to manipulate user settings without their consent, enabling unauthorized changes to account details, including the modification of passwords for all users, even those with admin privileges. This can lead to significant data breaches and compromise the security of user accounts.

References

https://github.com/dhananjay-bajaj/e107_2.1.8_csrf
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.