servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/147977/SearchBlox-8.6.6-Cross-Site-Request-Forgery.html | Exploit Third Party Advisory VDB Entry |
| https://gurelahmet.com/cve-2018-11538-csrf-privilege-escalation-creation-of-an-administrator-account-on-searchblox-8-6-6/ | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/44801/ | Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/147977/SearchBlox-8.6.6-Cross-Site-Request-Forgery.html | Exploit Third Party Advisory VDB Entry |
| https://gurelahmet.com/cve-2018-11538-csrf-privilege-escalation-creation-of-an-administrator-account-on-searchblox-8-6-6/ | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/44801/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 03:43
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/147977/SearchBlox-8.6.6-Cross-Site-Request-Forgery.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://gurelahmet.com/cve-2018-11538-csrf-privilege-escalation-creation-of-an-administrator-account-on-searchblox-8-6-6/ - Exploit, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/44801/ - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2018-06-01 19:29
Updated : 2024-11-21 03:43
NVD link : CVE-2018-11538
Mitre link : CVE-2018-11538
CVE.ORG link : CVE-2018-11538
JSON object : View
Products Affected
searchblox
- searchblox
CWE
CWE-352
Cross-Site Request Forgery (CSRF)