CVE-2011-5011 Multiple cross-site request forgery (CSRF) vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that (1) set a New...
MediumCVSS 6.8
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that (1) set a New user to Admin via the cID parameter to a statusconfirm action in admin/customers.php and (2) grant permissions to users via the cID parameter to a save action in admin/accounting.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xt-commerce | = 3.0.4-sp2.1 | No fix listed |
References
- dishix.blogspot.com third-party-advisory
- dishix.blogspot.com third-party-advisory
- 77498 broken-link vdb-entry
- 47032 third-party-advisory vendor-advisory
- xtcommerce-customers-accounting-csrf(71642) vdb-entry