CVE-2012-6433: XSS

Published Jan 3, 2013

Updated

Cross-site request forgery (CSRF) vulnerability in e107admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the newstitle parameter in a create action.

Affected Software

1 affected component

e107 e107=1.0.1

Remediation

Patch Available

http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/newspost.php?sortdir=down&r1=12622&r2=12992&sortby=rev

Event History

Jan 3, 2013

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-6433?

CVE-2012-6433 is rated as a medium severity vulnerability due to its potential to allow cross-site request forgery attacks against e107 administrators.

How do I fix CVE-2012-6433?

To mitigate CVE-2012-6433, it is recommended to upgrade to a patched version of e107 that addresses this CSRF vulnerability.

What systems are affected by CVE-2012-6433?

CVE-2012-6433 specifically affects e107 version 1.0.1.

What type of vulnerability is CVE-2012-6433?

CVE-2012-6433 is classified as a cross-site request forgery (CSRF) vulnerability.

Can CVE-2012-6433 lead to XSS attacks?

Yes, CVE-2012-6433 can be exploited to perform cross-site scripting (XSS) attacks by hijacking administrator authentication.