CVE-2019-1010094 Cross-site request forgery in DomainMOD
Cross-Site Request Forgery in DomainMOD allows attackers to change admin passwords if an authenticated administrator visits a malicious page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-1010094?
CVE-2019-1010094 is a high-severity vulnerability in DomainMOD, published on 18 Jul 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.
Weakness: CWE-352
Which versions are affected by CVE-2019-1010094?
It affects 1 product.
Products include Domainmod Domainmod.
How do I fix CVE-2019-1010094?
No fix has been published for CVE-2019-1010094 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-1010094 being exploited?
There is no known exploitation of CVE-2019-1010094 in the wild and no public exploit code.
Other vulnerabilities in DomainMOD
Sources
Also known as GHSA-546p-wp48-mhxq.