CVE-2010-5085

{"id": "CVE-2010-5085", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2012-02-14T20:55:04.423", "references": [{"url": "http://dev.hulihanapplications.com/issues/show/208", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=128104795219200&w=2", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/40874", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.htbridge.ch/advisory/xsrf_csrf_in_amethyst.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/67043", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2010/2022", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60947", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in admin/update_user in Hulihan Amethyst 0.1.5, and possibly earlier, allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrative password or (2) change the site's configuration."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en admin/update_user en Hulihan Amethyst v0.1.5, y posiblemente anteriores, permite a atacantes remotos secuestrar la autenticaci\u00f3n de administradores en peticiones que (1) cambian la contrase\u00f1a administrativa o (2) cambian la configuraci\u00f3n del sitio."}], "lastModified": "2017-08-29T01:29:12.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hulihanapplications:amethyst:0.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2864EF6-E738-40C0-89B0-3016C365D34F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}