CVEvulnerability

CVE-2010-0711

6.8 MEDIUM Published 2010-02-25 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-02-25
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attackers to hijack the authentication of an administrator for requests that (1) delete users via the delete action in the ma2 parameter or (2) create administrators via the update action in the ma2 parameter.

Affected configurations

• aspcodecms aspcode cms 1.5.8 • aspcodecms aspcode cms 2.0.0

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References