Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary code via the script parameter to admin/scripting.jsp.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2012/03/23/6 | mailing-list x_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2012/05/04/2 | mailing-list x_refsource_MLIST |
| http://openkm.svn.sourceforge.net/viewvc/openkm?view=revision&revision=7406 | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2012/03/23/8 | mailing-list x_refsource_MLIST |
| http://secunia.com/advisories/47420 | third-party-advisory x_refsource_SECUNIA |
| http://wiki.openkm.com/index.php/Changelog | x_refsource_CONFIRM |
| http://archives.neohapsis.com/archives/bugtraq/2012-01/0008.html | mailing-list x_refsource_BUGTRAQ |
| http://www.osvdb.org/78106 | vdb-entry x_refsource_OSVDB |
| http://www.openwall.com/lists/oss-security/2012/05/04/13 | mailing-list x_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2012/04/27/6 | mailing-list x_refsource_MLIST |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2012/03/23/6 | mailing-list x_refsource_MLIST x_transferred |
| http://www.openwall.com/lists/oss-security/2012/05/04/2 | mailing-list x_refsource_MLIST x_transferred |
| http://openkm.svn.sourceforge.net/viewvc/openkm?view=revision&revision=7406 | x_refsource_CONFIRM x_transferred |
| http://www.openwall.com/lists/oss-security/2012/03/23/8 | mailing-list x_refsource_MLIST x_transferred |
| http://secunia.com/advisories/47420 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://wiki.openkm.com/index.php/Changelog | x_refsource_CONFIRM x_transferred |
| http://archives.neohapsis.com/archives/bugtraq/2012-01/0008.html | mailing-list x_refsource_BUGTRAQ x_transferred |
| http://www.osvdb.org/78106 | vdb-entry x_refsource_OSVDB x_transferred |
| http://www.openwall.com/lists/oss-security/2012/05/04/13 | mailing-list x_refsource_MLIST x_transferred |
| http://www.openwall.com/lists/oss-security/2012/04/27/6 | mailing-list x_refsource_MLIST x_transferred |