SB2011041302 - Cross-site request forgery in phplist.com PHPlist

Description

This security bulletin contains information about 1 vulnerability.

1) Cross-site request forgery (CVE-ID: CVE-2011-1682)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and hijack the authentication of administrators for requests that (1) create a list or (2) insert cross-site scripting (XSS) sequences. NOTE: this issue exists because of an incomplete fix for CVE-2011-0748.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://secunia.com/advisories/44041
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66666
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66816