Unscored severity · published Sep 11, 2009
CVE-2008-7214
Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the…
–
CVSS
0.7%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a com_users action, as demonstrated using a separate XSS vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mambo · Mambo-foundation
through 4.6.3; 4.6.2 · source: NVD
MO
Mostlyce · Brilaps
through 2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-7214
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-7214
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html
forum.mambo-foundation.org
http://forum.mambo-foundation.org/showthread.php?t=10158
Exploit
http://osvdb.org/42531
Vendor Advisory
http://secunia.com/advisories/28670
Exploit
http://www.bugreport.ir/index_33.htm
www.securityfocus.com
http://www.securityfocus.com/archive/1/487128/100/200/threaded
More from Mostlyce
–
CVE-2008-7215
The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified…
–
CVE-2008-7213
Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and…
–
CVE-2008-7212
MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to…