Description
Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an adduser admin action.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | extplorer | 2.1.0b6+dfsg.2-1+squeeze1 | DSA-2510-1 |
Advisories 1
- DSA-2510-1 extplorer - Cross-site request forgery Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.autosectools.com/Advisories/eXtplorer.2.1.RC3_Cross-site.Request.Forgery_174.html
- DSA-2510 vendor-advisory
- [oss-security] 20120624 Re: CVE request: CSRF in eXtplorer mailing-list
- [oss-security] 20120624 CVE request: CSRF in eXtplorer mailing-list
- [oss-security] 20120626 Re: CVE request: CSRF in eXtplorer mailing-list
- [oss-security] 20120627 Re: CVE request: CSRF in eXtplorer mailing-list