{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-01-28T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a com_users action, as demonstrated using a separate XSS vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ADV-2008-0325", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/0325"}, {"name": "mambo-connector-csrf(39985)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39985"}, {"name": "20080227 Re: Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html"}, {"name": "42531", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/42531"}, {"name": "28670", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/28670"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://forum.mambo-foundation.org/showthread.php?t=10158"}, {"name": "20080128 Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/487128/100/200/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://www.bugreport.ir/index_33.htm"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-7214", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a com_users action, as demonstrated using a separate XSS vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2008-0325", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/0325"}, {"name": "mambo-connector-csrf(39985)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39985"}, {"name": "20080227 Re: Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html"}, {"name": "42531", "refsource": "OSVDB", "url": "http://osvdb.org/42531"}, {"name": "28670", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/28670"}, {"name": "http://forum.mambo-foundation.org/showthread.php?t=10158", "refsource": "CONFIRM", "url": "http://forum.mambo-foundation.org/showthread.php?t=10158"}, {"name": "20080128 Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/487128/100/200/threaded"}, {"name": "http://www.bugreport.ir/index_33.htm", "refsource": "MISC", "url": "http://www.bugreport.ir/index_33.htm"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-7214", "datePublished": "2009-09-11T16:00:00", "dateReserved": "2009-09-11T00:00:00", "dateUpdated": "2018-10-11T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mambo-foundation:mambo:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D2DE818-7FEA-48ED-BD22-A8760C1F297F", "versionEndIncluding": "4.6.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mambo-foundation:mambo:4.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "97BAB160-6BB4-4535-BA60-B25303793FBD", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:brilaps:mostlyce:*:*:*:*:*:*:*:*", "matchCriteriaId": "295DA818-1660-4534-A153-2F416C66D2D0", "versionEndIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a com_users action, as demonstrated using a separate XSS vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en administrator/index2.php en MOStlyCE anterior a la v2.4, como la usada en Mambo v4.6.3, permite a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para peticiones que a\u00f1aden nuevas cuentas de administradores a trav\u00e9s de una tarea guardada en una acci\u00f3n com_users, como se demostr\u00f3 usando una vulnerabilidad cross site scripting (XSS) separada en mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php."}], "id": "CVE-2008-7214", "lastModified": "2018-10-11T20:58:31.913", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2009-09-11T16:30:00.500", "references": [{"source": "cve@mitre.org", "url": "http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html"}, {"source": "cve@mitre.org", "url": "http://forum.mambo-foundation.org/showthread.php?t=10158"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://osvdb.org/42531"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/28670"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.bugreport.ir/index_33.htm"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/487128/100/200/threaded"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2008/0325"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39985"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}