Unscored severity · published Nov 26, 2012
CVE-2010-5285
Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the authentication of administrators for requests that add…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the authentication of administrators for requests that add administrative users via the edituser action.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Collabtive · O-dyn
0.6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-5285
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-5285
packetstormsecurity.org
http://packetstormsecurity.org/1010-exploits/collabtive-xssxsrf.txt
Vendor Advisory
http://secunia.com/advisories/41805
www.anatoliasecurity.com
http://www.anatoliasecurity.com/adv/as-adv-2010-003.txt
Exploit
http://www.exploit-db.com/exploits/15240
Exploit
http://www.securityfocus.com/bid/44050
More from Collabtive
9.8
CVE-2013-5027
Collabtive 1.0 has incorrect access control
8.8
CVE-2015-0258
Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary…
6.1
CVE-2020-13655
An issue was discovered in Collabtive 3.0 and later
5.4
CVE-2024-48708
Collabtive 3.1 is vulnerable to Cross-Site Scripting (XSS) via the name parameter in (a) file tasklist.php under action = add/edit and in (b) file admin.php under action =…
5.4
CVE-2024-48707
Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under (a) action=add or action=edit within managemilestone.php file and (b) action=addpro within…