Join our subscribers
Cross-Site Request Forgery (CSRF) in CMS Made Simple
| Advisory ID: | HTB23121 |
| Product: | CMS Made Simple |
| Vendor: | CMS Made Simple |
| Vulnerable Versions: | 1.11.2 and probably prior |
| Tested Version: | 1.11.2 |
| Advisory Publication: | October 17, 2012 [without technical details] |
| Vendor Notification: | October 17, 2012 |
| Vendor Fix: | October 17, 2012 |
| Public Disclosure: | November 7, 2012 |
| Latest Update: | October 24, 2012 |
| Vulnerability Type: | Cross-Site Request Forgery [CWE-352] |
| CVE Reference: | CVE-2012-5450 |
| Risk Level: | Low |
 | |
| CVSSv2 Base Score: | 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge Security Research Lab discovered vulnerability in CMS Made Simple, which can be exploited to perform cross-site request forgery (CSRF) attacks. | |
| Solution: | |
| Upgrade to CMSMS 1.11.2.1 More Information: http://forum.cmsmadesimple.org/viewtopic.php?f=1&t=63545 | |
References: | |
| [1] High-Tech Bridge Advisory HTB23121 - https://www.immuniweb.com/advisory/HTB23121 - Сross-Site Request Forgery (CSRF) in CMS Made Simple. [2] CMS Made Simple - http://www.cmsmadesimple.org - CMS Made Simple, an open source content management system, allows for faster and easier management of website content. This CMS is scalable for small businesses to large corporations. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
