CVE-2011-1482: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in mainfile.php in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts or (2) grant the administrative privilege to a user account, related to a Referer check that uses a substring comparison.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1482?
CVE-2011-1482 has a medium severity rating due to its potential for CSRF attacks on administrator functionalities.
How do I fix CVE-2011-1482?
To fix CVE-2011-1482, it's recommended to upgrade to a version of PHP-Nuke that is later than 8.0 which resolves the CSRF vulnerabilities.
What versions of PHP-Nuke are affected by CVE-2011-1482?
CVE-2011-1482 affects all versions of PHP-Nuke up to and including 8.0.
What type of attacks can CVE-2011-1482 enable?
CVE-2011-1482 enables remote attackers to perform CSRF attacks which can hijack the authentication of administrators.
Can I mitigate CVE-2011-1482 without upgrading PHP-Nuke?
Mitigation of CVE-2011-1482 without upgrading can be challenging; implementing CSRF tokens in requests can be a temporary workaround.