CVEvulnerability
CVE-2010-2039
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-05-25
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Cross-site request forgery (CSRF) vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an Admin_Users action to index.php. NOTE: some of these details are obtained from third party information.
Affected configurations
• gpeasy gpeasy cms (<= 1.6.2)
• gpeasy gpeasy cms 1.5
• gpeasy gpeasy cms 1.6
• gpeasy gpeasy cms 1.6.1
• gpeasy gpeasy cms 1.6.3
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://packetstormsecurity.org/1004-exploits/gpeasy-xsrf.txt Exploit
- http://secunia.com/advisories/39643 Vendor Advisory
- http://www.exploit-db.com/exploits/12441 Exploit
- http://www.osvdb.org/64130 www.osvdb.org
- http://www.vupen.com/english/advisories/2010/1030 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58214 exchange.xforce.ibmcloud.com
- http://packetstormsecurity.org/1004-exploits/gpeasy-xsrf.txt Exploit
- http://secunia.com/advisories/39643 Vendor Advisory
- http://www.exploit-db.com/exploits/12441 Exploit
- http://www.osvdb.org/64130 www.osvdb.org
- http://www.vupen.com/english/advisories/2010/1030 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58214 exchange.xforce.ibmcloud.com