Description
TorrentFlux 2.4 allows remote authenticated users to delete or modify other users' cookies via the cid parameter in an editCookies action to profile.php.
References
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759573
- [oss-security] 20140829 RE: CVE requests for 2 separate vulns in torrentflux 2.4.5-1 (debian stable) mailing-list
- 1030791 vdb-entry
- [oss-security] 20140902 Re: CVE requests for 2 separate vulns in torrentflux 2.4.5-1 (debian stable) mailing-list