CVE-2018-7634: CSRF
First published: Thu Mar 01 2018(Updated: )
An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse the functionality by attackers. By making a CSRF attack, an attacker could make a victim change his registered e-mail address on the application, leading to account takeover.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Enalean Tuleap | =9.17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Enalean/tuleap/commit/0843c046eee54b16ec6a7753c575838212770189
- https://mustafairan.wordpress.com/2018/03/05/tuleap-mail-change-csrf-vulnerability-leads-to-account-takeover/
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?p=tuleap%2Fstable.git&a=commit&h=d6701289ae55de900929ff0f66313fa9771a198d
- https://tuleap.net/plugins/tracker/?aid=11217
- https://twitter.com/Mustafaran/status/970745812887199744
Frequently Asked Questions
What is CVE-2018-7634?
CVE-2018-7634 is a vulnerability in Enalean Tuleap 9.17 that allows attackers to perform CSRF attacks to change a user's registered email address, potentially leading to account takeover.
What is the severity of CVE-2018-7634?
The severity of CVE-2018-7634 is rated as high, with a CVSS score of 8.8.
How does CVE-2018-7634 affect Enalean Tuleap 9.17?
CVE-2018-7634 affects Enalean Tuleap 9.17 by not mitigating CSRF attacks when changing an email address, which can be exploited by attackers to abuse the functionality.
How can the CVE-2018-7634 vulnerability be exploited?
The CVE-2018-7634 vulnerability can be exploited by performing a CSRF attack to make a victim change their registered email address on the Enalean Tuleap 9.17 application.
Is there a fix for CVE-2018-7634?
Yes, a fix for CVE-2018-7634 is available. It is recommended to update Enalean Tuleap to a version that includes the necessary mitigation measures.
- collector/nvd-index
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/last-modified-date
- agent/severity
- agent/first-publish-date
- agent/event
- agent/description
- vendor/enalean
- canonical/enalean tuleap
- version/enalean tuleap/9.17