CSRF in Seeds Acmailer

CVE-2014-3896

Multiple cross-site request forgery (CSRF) vulnerabilities in CGI programs in Seeds acmailer before 3.8.17 and 3.9.x before 3.9.10 Beta allow remote attackers to hijack the authentication of arbitrary users for requests that modify or delete data, as demonstrated by modifying data affecting authorization.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.009 (56.8th percentile) — read the EPSS interpretation.

Affected products

Seeds Acmailer
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

vultures@jpcert.or.jp (x_refsource_CONFIRM, Exploit, Vendor Advisory)
vultures@jpcert.or.jp (x_refsource_JVNDB, VDB Entry, Third Party Advisory, third-party-advisory)
vultures@jpcert.or.jp (VDB Entry, Third Party Advisory, x_refsource_JVN, third-party-advisory)