CVEvulnerability
CVE-2008-7214
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-09-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a com_users action, as demonstrated using a separate XSS vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php.
Affected configurations
• mambo-foundation mambo (<= 4.6.3)
• mambo-foundation mambo 4.6.2
• brilaps mostlyce (<= 2.0)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html archives.neohapsis.com
- http://forum.mambo-foundation.org/showthread.php?t=10158 forum.mambo-foundation.org
- http://osvdb.org/42531 Exploit
- http://secunia.com/advisories/28670 Vendor Advisory
- http://www.bugreport.ir/index_33.htm Exploit
- http://www.securityfocus.com/archive/1/487128/100/200/threaded www.securityfocus.com
- http://www.vupen.com/english/advisories/2008/0325 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39985 exchange.xforce.ibmcloud.com
- http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html archives.neohapsis.com
- http://forum.mambo-foundation.org/showthread.php?t=10158 forum.mambo-foundation.org
- http://osvdb.org/42531 Exploit
- http://secunia.com/advisories/28670 Vendor Advisory
- http://www.bugreport.ir/index_33.htm Exploit
- http://www.securityfocus.com/archive/1/487128/100/200/threaded www.securityfocus.com
- http://www.vupen.com/english/advisories/2008/0325 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39985 exchange.xforce.ibmcloud.com