CVE-2010-5084: CSRF
The cross-site request forgery (CSRF) protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrator account, which allows remote attackers to hijack the authentication of administrators for requests that add new users via e107admin/users.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-5084?
CVE-2010-5084 is classified as a high severity vulnerability due to its ability to allow remote attackers to hijack the authentication of administrators.
How do I fix CVE-2010-5084?
To fix CVE-2010-5084, you should update e107 to version 0.7.23 or later, which contains the necessary security patch.
Which versions of e107 are affected by CVE-2010-5084?
CVE-2010-5084 affects e107 versions prior to 0.7.23, including 0.6175, 0.616, and several others up to 0.7.22.
What type of vulnerability is CVE-2010-5084?
CVE-2010-5084 is a cross-site request forgery (CSRF) vulnerability that exploits a predictable random token mechanism.
Can CVE-2010-5084 be mitigated without an update?
Mitigating CVE-2010-5084 without updating is challenging, but administrators can limit access to sensitive actions based on user roles.