CVE-2004-1842

Cross-site request forgery (CSRF) vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via an img tag with a URL to admin.php.

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://marc.info/?l=bugtraq&m=108006309112075&w=2	Mailing List
http://secunia.com/advisories/11195	Broken Link
http://www.securityfocus.com/bid/9895	Broken Link Exploit Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/15596	Third Party Advisory VDB Entry
http://marc.info/?l=bugtraq&m=108006309112075&w=2	Mailing List
http://secunia.com/advisories/11195	Broken Link
http://www.securityfocus.com/bid/9895	Broken Link Exploit Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/15596	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:phpnuke:php-nuke:*:*:*:*:*:*:*:*

History

20 Nov 2024, 23:51

Type	Values Removed	Values Added
References	~~() http://marc.info/?l=bugtraq&m=108006309112075&w=2 - Mailing List~~	() http://marc.info/?l=bugtraq&m=108006309112075&w=2 - Mailing List
References	~~() http://secunia.com/advisories/11195 - Broken Link~~	() http://secunia.com/advisories/11195 - Broken Link
References	~~() http://www.securityfocus.com/bid/9895 - Broken Link, Exploit, Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/9895 - Broken Link, Exploit, Third Party Advisory, VDB Entry
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/15596 - Third Party Advisory, VDB Entry~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/15596 - Third Party Advisory, VDB Entry

08 Feb 2024, 20:46

Type	Values Removed	Values Added
CVSS	v2 : ~~7.5~~ v3 : ~~unknown~~	v2 : 6.8 v3 : 8.8
References	~~(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/15596 -~~	(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/15596 - Third Party Advisory, VDB Entry
References	~~(SECUNIA) http://secunia.com/advisories/11195 -~~	(SECUNIA) http://secunia.com/advisories/11195 - Broken Link
References	~~(BUGTRAQ) http://marc.info/?l=bugtraq&m=108006309112075&w=2 -~~	(BUGTRAQ) http://marc.info/?l=bugtraq&m=108006309112075&w=2 - Mailing List
References	~~(BID) http://www.securityfocus.com/bid/9895 - Exploit~~	(BID) http://www.securityfocus.com/bid/9895 - Broken Link, Exploit, Third Party Advisory, VDB Entry
CPE	cpe:2.3:a:francisco_burzi:php-nuke:7.0:::::::* cpe:2.3:a:francisco_burzi:php-nuke:6.5_beta1:::::::* cpe:2.3:a:francisco_burzi:php-nuke:6.5_rc3:::::::* cpe:2.3:a:francisco_burzi:php-nuke:6.5_rc1:::::::* cpe:2.3:a:francisco_burzi:php-nuke:6.0:::::::* cpe:2.3:a:francisco_burzi:php-nuke:6.5_rc2:::::::* cpe:2.3:a:francisco_burzi:php-nuke:6.7:::::::* cpe:2.3:a:francisco_burzi:php-nuke:6.9:::::::* cpe:2.3:a:francisco_burzi:php-nuke:6.5:::::::* cpe:2.3:a:francisco_burzi:php-nuke:7.1:::::::* cpe:2.3:a:francisco_burzi:php-nuke:6.5_final:::::::* cpe:2.3:a:francisco_burzi:php-nuke:6.6:::::::* cpe:2.3:a:francisco_burzi:php-nuke:7.0_final:::::::*	cpe:2.3:a:phpnuke:php-nuke::::::::
First Time		Phpnuke php-nuke Phpnuke
CWE	~~NVD-CWE-Other~~	CWE-352

Information

Published : 2004-12-31 05:00

Updated : 2024-11-20 23:51

NVD link : CVE-2004-1842

Mitre link : CVE-2004-1842

CVE.ORG link : CVE-2004-1842

JSON object : View

Products Affected

phpnuke

php-nuke

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

8.8 /10