« Volver al listado

CVE-2008-5672

Estado: ModificadaMedia (6.8)—

Multiple cross-site request forgery (CSRF) vulnerabilities in PHParanoid before 0.4 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) admin.php or (2) private messages.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Phparanoid — Phparanoid

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-5672",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-12-19T01:52:02.627",
  "references": [
    {
      "url": "http://secunia.com/advisories/28847",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sourceforge.net/project/shownotes.php?release_id=575358",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40518",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28847",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/project/shownotes.php?release_id=575358",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40518",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in PHParanoid before 0.4 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) admin.php or (2) private messages."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de tipo cross-site request forgery (CSRF) en PHParanoid en versiones anteriores a 0.4,  permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para peticiones que usan (1) el archivo admin.php y (2) mensajes privados."
    }
  ],
  "lastModified": "2026-06-16T23:00:46.493",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phparanoid:phparanoid:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "614B53FC-1301-4B06-821A-7C52462679F9",
              "versionEndIncluding": "0.3"
            },
            {
              "criteria": "cpe:2.3:a:phparanoid:phparanoid:0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C004DC1-9DF7-4870-A4E3-916F9254D4AA"
            },
            {
              "criteria": "cpe:2.3:a:phparanoid:phparanoid:0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "507C2B36-7646-4D0B-A099-357FE17176D9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}