Description

e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbitrary page.

Remediation

References

CVE-2018-17081

Related Vulnerabilities

WordPress Plugin Multisite Plugin Manager Multiple Cross-Site Scripting Vulnerabilities (3.1.1)

Moodle Improper Input Validation Vulnerability (CVE-2012-6101)

WordPress Plugin Gallery Objects SQL Injection (0.4)

Dotclear Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-1584)

Drupal Core 8.8.x Security Bypass (8.8.0 - 8.8.9)

Severity

Medium

Classification

CVE-2018-17081 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities