Description

SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism and hijack the authentication of administrators via vectors related to "form action requests" using a controller.

Remediation

References

CVE-2010-5087

Related Vulnerabilities

WordPress Plugin Really Simple Share Unspecified Vulnerability (4.3.6)

WordPress Plugin Analytics Stats Counter Statistics PHP Object Injection (1.2.2.5)

Werkzeug WSGI Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-10516)

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-20001)

Apache Traffic Server CVE-2023-30631 Vulnerability (CVE-2023-30631)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2010-5087