CVE-2011-4173 Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involvi...
MediumCVSS 6.8
EPSS 0.59%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simplemachines smf | = 2.0 | No fix listed |
| simplemachines smf | = 2.0-beta1 | No fix listed |
| simplemachines smf | = 2.0-beta2 | No fix listed |
| simplemachines smf | = 2.0-beta2.1 | No fix listed |
| simplemachines smf | = 2.0-beta3 | No fix listed |
| simplemachines smf | = 2.0-beta3.1 | No fix listed |
| simplemachines smf | = 2.0-beta4 | No fix listed |
| simplemachines smf | = 2.0-rc1 | No fix listed |
| simplemachines smf | = 2.0-rc1.2 | No fix listed |
| simplemachines smf | = 2.0-rc2 | No fix listed |
| simplemachines smf | = 2.0-rc3 | No fix listed |
| simplemachines smf | = 2.0-rc4 | No fix listed |
| simplemachines smf | = 2.0-rc5 | No fix listed |
References
- [oss-security] 20111009 CVE request: simple machines forum before 2.0.1 and 1.1.15 mailing-list
- [oss-security] 20111010 Re: CVE request: simple machines forum before 2.0.1 and 1.1.15 mailing-list
- 46386 third-party-advisory vendor-advisory
- www.simplemachines.org vendor-advisory