CVE-2013-7251

ProjectForge < 5.3 - Cross-Site Request Forgery in Multiple Admin and Core Endpoints

Title source: llm
STIX 2.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) web/admin/, (2) web/core/, (3) web/dialog/, (4) web/fibu/, (5) web/mobile/, (6) web/task/, or (7) web/wicket/.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/64632
Various Sources x_refsource_confirm
https://www.projectforge.org/jira/browse/PF-485
Various Sources x_refsource_confirm
http://www.projectforge.org/pf-en/News

Scores

EPSS 0.0110
EPSS Percentile 61.8%

Details

CWE
CWE-352
Status published
Products (3)
projectforge/projectforge 5.0
projectforge/projectforge 5.1
projectforge/projectforge < 5.2
Published Jan 02, 2014
Tracked Since Feb 18, 2026