CVE-2013-5954 Cross-site request forgery in n/a
Remote attackers can trick administrators into deleting users, advertisers, banners, campaigns, channels, affiliates, or zones via CSRF.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2013-5954?
CVE-2013-5954 is a medium-severity vulnerability in Revive-Adserver Revive Adserver, published on 25 Apr 2014. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php.
Weakness: CWE-352
Which versions are affected by CVE-2013-5954?
It affects 2 products.
Products include Openx Openx, Revive-Adserver Revive Adserver.
How do I fix CVE-2013-5954?
No fix has been published for CVE-2013-5954 yet. Limit exposure of the affected software until one is available.
Is CVE-2013-5954 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-5954 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Revive-Adserver Revive Adserver
Sources
Also known as GHSA-cw6g-hqgc-xf24.