CVE-2015-3624 Cross-site request forgery (CSRF) vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System (CMS) before 9.10 SP1 (Build 9.1.0.184.1.120) allows remote at...
MediumCVSS 5.8
EPSS 2.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site request forgery (CSRF) vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System (CMS) before 9.10 SP1 (Build 9.1.0.184.1.120) allows remote attackers to hijack the authentication of content administrators for requests that delete content via a delete action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ektron content management system | <= 9.1 | No fix listed |
References
- packetstormsecurity.com exploit
- v00d00sec.com exploit
- 20150531 Ektron CMS 9.10 SP1 - CSRF Vulnerability mailing-list
- 74937 vdb-entry
- 37296 exploit