Unscored CVE-2010-2294 EUVD-2010-2304GHSA-8www-9hq8-f2fw

Cross-site request forgery (CSRF) vulnerability in Plume CMS 1.2.4 and possibly earlier allows remote attackers to hijack the authenticatio…

Published Jun 15, 2010 · Updated Aug 7, 2024 · Assigned by mitre

Description

Cross-site request forgery (CSRF) vulnerability in Plume CMS 1.2.4 and possibly earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors.

References

plumecms-password-csrf(59308) vdb-entry
40133 third-party-advisory
ADV-2010-1430 vdb-entry
20100609 [MajorSecurity SA-070]Plume CMS - change Admin Password via Cross-site Request Forgery mailing-list