CVE-2014-3896 Multiple cross-site request forgery (CSRF) vulnerabilities in CGI programs in Seeds acmailer before 3.8.17 and 3.9.x before 3.9.10 Beta allow remote attackers to hijack the authentication of arbitrary...
MediumCVSS 6.8
EPSS 0.92%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in CGI programs in Seeds acmailer before 3.8.17 and 3.9.x before 3.9.10 Beta allow remote attackers to hijack the authentication of arbitrary users for requests that modify or delete data, as demonstrated by modifying data affecting authorization.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| seeds acmailer | >= 3.8.0, < 3.8.17 | 3.8.17 |
| seeds acmailer | >= 3.9.0, < 3.9.10 | 3.9.10 |
References
- JVN#42511610 third-party-advisory vdb-entry
- JVNDB-2014-000089 third-party-advisory vdb-entry
- www.acmailer.jp exploit vendor-advisory