CVE-2010-5084

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-02-14 · updated 2026-06-16
Weakness: CWE-352

Description

The cross-site request forgery (CSRF) protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrator account, which allows remote attackers to hijack the authentication of administrators for requests that add new users via e107_admin/users.php.

Affected products

e107 CMS: through 0.7.22; 0.6_10, 0.6_11, 0.6_12, 0.6_13, 0.6_14, 0.6_15 (+58)

References

http://e107.org/comment.php?comment.news.872
http://secunia.com/advisories/41034
http://www.madirish.net/?article=471
http://www.securitytracker.com/id?1024351
http://e107.org/comment.php?comment.news.872
http://secunia.com/advisories/41034
http://www.madirish.net/?article=471
http://www.securitytracker.com/id?1024351

Get alerted when CVE-2010-5084 or the next vulnerability affects your stack