CVE-2012-1901 Multiple cross-site request forgery (CSRF) vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to (1) hijack the authentication of users for requests that change account settings via a...
MediumCVSS 6.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to (1) hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or (2) hijack the authentication of administrators for requests that add a new page via a request to admin/pages-new-save.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flexcms | <= 3.2.1 | No fix listed |
| flexcms | = 2.0 | No fix listed |
| flexcms | = 2.5 | No fix listed |
References
- ivanobinetti.blogspot.com
- 48451 third-party-advisory vendor-advisory
- 18609 exploit