CVEvulnerability

CVE-2013-5954

6.8 MEDIUM Published 2014-04-25 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2014-04-25
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-352

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php.

Affected configurations

• revive-adserver revive adserver (<= 3.0.4) • openx openx (<= 2.8.11) • openx openx 2.8 • openx openx 2.8.1 • openx openx 2.8.2 • openx openx 2.8.3 • openx openx 2.8.4 • openx openx 2.8.5 • openx openx 2.8.6 • openx openx 2.8.7 • openx openx 2.8.8 • openx openx 2.8.9 • openx openx 2.8.10

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References