Multiple Vulnerabilities in KrisonAV CMS
Advisory ID: | HTB23150 |
Product: | KrisonAV CMS |
Vendor: | KrisonAV |
Vulnerable Versions: | 3.0.1 and probably prior |
Tested Version: | 3.0.1 |
Advisory Publication: | March 27, 2013 [without technical details] |
Vendor Notification: | March 27, 2013 |
Vendor Fix: | March 31, 2013 |
Public Disclosure: | April 17, 2013 |
Latest Update: | April 1, 2013 |
Vulnerability Type: | Cross-Site Scripting [CWE-79] Cross-Site Request Forgery [CWE-352] |
CVE References: | CVE-2013-2712 CVE-2013-2713 |
Risk Level: | Medium |
![]() | |
CVSSv2 Base Scores: | 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P) |
Solution Status: | Fixed by Vendor |
Discovered and Provided: | High-Tech Bridge Security Research Lab |
Advisory Details: | |
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in KrisonAV CMS, which can be exploited to perform cross-site scripting and cross-site request forgery attacks. | |
Solution: | |
Upgrade to KrisonAV CMS 3.0.2 More Information: http://www.krisonav.com/articles_show.html?articles_id=release-notes | |
References: | |
[1] High-Tech Bridge Advisory HTB23150 - https://www.immuniweb.com/advisory/HTB23150 - Multiple Vulnerabilities in KrisonAV CMS. [2] KrisonAV CMS - http://www.krisonav.com - KrisonAV is a content management system (CMS), which enables you to build Web sites and online applications. It is based on Codecharge Studio, that makes it extremely powerful and secure. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.