CSRF in Zikula Application Framework

CVE-2010-4729

Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword form and (2) mailpasswd processing, which makes it easier for remote attackers to generate a flood of password requests and possibly conduct cross-site request forgery (CSRF) attacks via multiple form submissions.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.005 (41.4th percentile) — read the EPSS interpretation.

Affected products

Zikula Zikula_application_framework — versions 1.1.2, 1.2.1
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

cve@mitre.org (x_refsource_CONFIRM)
cve@mitre.org (x_refsource_CONFIRM)