CVE-2010-3603: CSRF
First published: Fri Sep 24 2010(Updated: )
Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to hijack the authentication of administrators for requests that rename arbitrary files, as demonstrated by causing the user.config file to be moved, leading to a denial of service (service stop) and possibly the exposure of sensitive information.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MojoPortal | =2.3.4.3 | |
| MojoPortal | =2.3.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://osvdb.org/68060
- http://packetstormsecurity.org/1009-advisories/moaub16-mojoportal.pdf
- http://packetstormsecurity.org/1009-exploits/moaub-mojoportal.txt
- http://secunia.com/advisories/41481
- http://www.exploit-db.com/exploits/15018
- http://www.mojoportal.com/mojoportal-2352-released.aspx
- https://exchange.xforce.ibmcloud.com/vulnerabilities/61834
Frequently Asked Questions
What is the severity of CVE-2010-3603?
CVE-2010-3603 is considered a medium severity vulnerability due to its potential for cross-site request forgery attacks.
What vulnerability does CVE-2010-3603 address?
CVE-2010-3603 addresses a cross-site request forgery vulnerability in the file manager service of mojoPortal.
How can I fix CVE-2010-3603?
To fix CVE-2010-3603, update mojoPortal to versions 2.3.4.4 or 2.3.5.2 or later, which include security improvements.
Who is affected by CVE-2010-3603?
CVE-2010-3603 affects users of mojoPortal versions 2.3.4.3 and 2.3.5.1.
What kind of attacks can exploit CVE-2010-3603?
CVE-2010-3603 can be exploited to hijack the authentication of administrators and perform unauthorized actions such as renaming files.
- agent/references
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/remedy
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- agent/severity
- agent/description
- vendor/sourcetreesolutions
- canonical/mojoportal
- version/mojoportal/2.3.4.3
- version/mojoportal/2.3.5.1