CVEvulnerability
CVE-2013-4881
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-08-19
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php.
Affected configurations
• bigtreecms bigtree cms (<= 4.0)
• bigtreecms bigtree cms 4.0
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://archives.neohapsis.com/archives/bugtraq/2013-08/0039.html archives.neohapsis.com
- http://osvdb.org/96009 osvdb.org
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86286 exchange.xforce.ibmcloud.com
- https://github.com/bigtreecms/BigTree-CMS/commit/4b0faa90fa8b9e1776c86db716894dcd7e6b4834 github.com
- https://www.htbridge.com/advisory/HTB23165 www.htbridge.com
- http://archives.neohapsis.com/archives/bugtraq/2013-08/0039.html archives.neohapsis.com
- http://osvdb.org/96009 osvdb.org
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86286 exchange.xforce.ibmcloud.com
- https://github.com/bigtreecms/BigTree-CMS/commit/4b0faa90fa8b9e1776c86db716894dcd7e6b4834 github.com
- https://www.htbridge.com/advisory/HTB23165 www.htbridge.com