CVE-2018-18449: CSRF
Published Mar 7, 2019
·Updated
EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339.
Affected Software
1 affected component
Phome Empirecms=7.5
Event History
Mar 7, 2019
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-18449?
CVE-2018-18449 is classified as a medium severity vulnerability due to its potential for CSRF attacks allowing unauthorized user account creation.
2
How do I fix CVE-2018-18449?
To mitigate CVE-2018-18449, ensure that CSRF tokens are implemented for the user account creation process in EmpireCMS.
3
What software is affected by CVE-2018-18449?
CVE-2018-18449 specifically affects EmpireCMS version 7.5.
4
What type of vulnerability is CVE-2018-18449?
CVE-2018-18449 is a Cross-Site Request Forgery (CSRF) vulnerability.
5
Can CVE-2018-18449 allow unauthorized access?
Yes, CVE-2018-18449 can be exploited to add user accounts without proper authorization.