CVE-2018-15682 An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to automate the action of sending private messages to users by luring an authenticated....
HighCVSS 8.8
EPSS 0.54%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to automate the action of sending private messages to users by luring an authenticated user to a web page that automatically submits a form on their behalf.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| btiteam xbtit | <= 2.5.4 | No fix listed |
References
- rastating.github.io exploit third-party-advisory