CSRF in Devincentiis Gazie
CVE-2012-1220
Cross-site request forgery (CSRF) vulnerability in modules/config/admin_utente.php in GAzie 5.20 and earlier allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action, as demonstrated by changing the password.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.011 (61.1th percentile) — read the EPSS interpretation.
Affected products
- Devincentiis Gazie — versions 2.0.7, 2.0.8, 2.0.9
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (Exploit, exploit, x_refsource_EXPLOIT-DB)