CVE-2011-4947: XSS
Published Aug 31, 2012
·Updated
Cross-site request forgery (CSRF) vulnerability in e107admin/usersextended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the userinclude parameter.
Affected Software
25 affected components
e107 e107<=0.7.24
e107 e107=0.7
e107 e107=0.7.0
e107 e107=0.7.1
e107 e107=0.7.2
e107 e107=0.7.3
e107 e107=0.7.4
e107 e107=0.7.5
e107 e107=0.7.6
e107 e107=0.7.7
e107 e107=0.7.8
e107 e107=0.7.9
e107 e107=0.7.10
e107 e107=0.7.11
e107 e107=0.7.12
e107 e107=0.7.13
e107 e107=0.7.14
e107 e107=0.7.15
e107 e107=0.7.16
e107 e107=0.7.17
e107 e107=0.7.18
e107 e107=0.7.19
e107 e107=0.7.20
e107 e107=0.7.21
e107 e107=0.7.22
Event History
Aug 31, 2012
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-4947?
CVE-2011-4947 is rated as medium severity due to its potential to allow unauthorized actions by attackers.
2
How do I fix CVE-2011-4947?
To fix CVE-2011-4947, upgrade to e107 version 0.7.26 or later.
3
What types of attacks can CVE-2011-4947 facilitate?
CVE-2011-4947 can facilitate cross-site request forgery attacks, leading to unauthorized actions by administrators.
4
Which versions of e107 are affected by CVE-2011-4947?
CVE-2011-4947 affects all e107 versions prior to 0.7.26.
5
Can CVE-2011-4947 lead to XSS vulnerabilities?
Yes, attackers can exploit CVE-2011-4947 to insert cross-site scripting (XSS) sequences through specific parameters.