CVE-2011-5074

Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to hijack the authentication of administrators for requests that change administrator email, add a new administrator, or insert arbitrary script via (1) user_profile_edit.php or (2) user_add.php.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/46019	Vendor Advisory
http://sitracker.org/wiki/ReleaseNotes365
http://www.securityfocus.com/archive/1/519636	Exploit
https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_sit_support_incident_tracker.html	Exploit
http://secunia.com/advisories/46019	Vendor Advisory
http://sitracker.org/wiki/ReleaseNotes365
http://www.securityfocus.com/archive/1/519636	Exploit
https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_sit_support_incident_tracker.html	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sitracker:support_incident_tracker::::::::
	cpe:2.3:a:sitracker:support_incident_tracker:3.6:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.21:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.22:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.22pl1:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.23:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.24:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.24:beta-2::::::
	cpe:2.3:a:sitracker:support_incident_tracker:3.30:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.30:beta2::::::
	cpe:2.3:a:sitracker:support_incident_tracker:3.31:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.32:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.33:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.35:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.35:beta1::::::
	cpe:2.3:a:sitracker:support_incident_tracker:3.36:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.40:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.40:beta1::::::
	cpe:2.3:a:sitracker:support_incident_tracker:3.41:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.45:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.45:beta1::::::
	cpe:2.3:a:sitracker:support_incident_tracker:3.50:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.50:beta1::::::
	cpe:2.3:a:sitracker:support_incident_tracker:3.51:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.60:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.61:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.62:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.63:::::::*
	cpe:2.3:a:sitracker:support_incident_tracker:3.63:beta1::::::

History

21 Nov 2024, 01:33

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/46019 - Vendor Advisory~~	() http://secunia.com/advisories/46019 - Vendor Advisory
References	~~() http://sitracker.org/wiki/ReleaseNotes365 -~~	() http://sitracker.org/wiki/ReleaseNotes365 -
References	~~() http://www.securityfocus.com/archive/1/519636 - Exploit~~	() http://www.securityfocus.com/archive/1/519636 - Exploit
References	~~() https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_sit_support_incident_tracker.html - Exploit~~	() https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_sit_support_incident_tracker.html - Exploit

Information

Published : 2012-01-29 11:55

Updated : 2024-11-21 01:33

NVD link : CVE-2011-5074

Mitre link : CVE-2011-5074

CVE.ORG link : CVE-2011-5074

JSON object : View

Products Affected

sitracker

support_incident_tracker

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

6.8 /10