CVE-2011-3994 Cross-site request forgery (CSRF) vulnerability in SKYARC MTCMS before 5.252, and the MultiFileUploader 0.44 and earlier, DuplicateEntry 1.2 and earlier, MailPack 1.741 and earlier, and AutoTagging 0....
MediumCVSS 6.8
EPSS 0.59%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in SKYARC MTCMS before 5.252, and the MultiFileUploader 0.44 and earlier, DuplicateEntry 1.2 and earlier, MailPack 1.741 and earlier, and AutoTagging 0.08 and earlier plugins for Movable Type, allows remote attackers to hijack the authentication of arbitrary users for requests that modify data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| skyarc autotagging | <= 0.08 | No fix listed |
| skyarc duplicateentry | <= 1.2 | No fix listed |
| skyarc mailpack | <= 1.741 | No fix listed |
| skyarc mtcms | <= 5.251 | No fix listed |
| skyarc mtcms | = 5.2 | No fix listed |
| skyarc mtcms | = 5.21 | No fix listed |
| skyarc mtcms | = 5.22 | No fix listed |
| skyarc mtcms | = 5.23 | No fix listed |
| skyarc mtcms | = 5.24 | No fix listed |
| skyarc mtcms | = 5.25 | No fix listed |
| skyarc mtcms | = 5.251 | No fix listed |
| skyarc multifileuploader | <= 0.44 | No fix listed |
References
- JVN#56667137 third-party-advisory
- JVNDB-2011-000094 third-party-advisory
- www.mtcms.jp