CVE-2016-2539: CSRF
Published Feb 7, 2017
·Updated
Cross-site request forgery (CSRF) vulnerability in installmodules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file.
Affected Software
1 affected component
ATutor ATutor<=2.2.1
Remediation
Event History
Feb 7, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-2539?
CVE-2016-2539 is considered a critical vulnerability due to its potential to allow remote code execution.
2
How do I fix CVE-2016-2539?
To fix CVE-2016-2539, upgrade to ATutor version 2.2.2 or later, which addresses the CSRF vulnerability.
3
What type of vulnerability is CVE-2016-2539?
CVE-2016-2539 is a cross-site request forgery (CSRF) vulnerability.
4
Which versions of ATutor are affected by CVE-2016-2539?
CVE-2016-2539 affects all ATutor versions prior to 2.2.2.
5
What can attackers achieve with CVE-2016-2539?
Attackers can hijack user authentication and execute arbitrary PHP code through crafted zip file uploads.