CVE-2011-3994
Estado: ModificadaMedia (6.8)—
Cross-site request forgery (CSRF) vulnerability in SKYARC MTCMS before 5.252, and the MultiFileUploader 0.44 and earlier, DuplicateEntry 1.2 and earlier, MailPack 1.741 and earlier, and AutoTagging 0.08 and earlier plugins for Movable Type, allows remote attackers to hijack the authentication of arbitrary users for requests that modify data.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
- Puntuación base: 6.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.59%
- Percentil entre todas las CVEs puntuadas: 46
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (5)
CWE
- CWE-352
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2011-3994",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "vultures@jpcert.or.jp",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2011-11-03T17:55:01.827",
"references": [
{
"url": "http://jvn.jp/en/jp/JVN56667137/index.html",
"source": "vultures@jpcert.or.jp"
},
{
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000094",
"source": "vultures@jpcert.or.jp"
},
{
"url": "http://www.mtcms.jp/news/product/201110131921.html",
"source": "vultures@jpcert.or.jp"
},
{
"url": "http://jvn.jp/en/jp/JVN56667137/index.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000094",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.mtcms.jp/news/product/201110131921.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in SKYARC MTCMS before 5.252, and the MultiFileUploader 0.44 and earlier, DuplicateEntry 1.2 and earlier, MailPack 1.741 and earlier, and AutoTagging 0.08 and earlier plugins for Movable Type, allows remote attackers to hijack the authentication of arbitrary users for requests that modify data."
},
{
"lang": "es",
"value": "Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en SKYARC MTCMS anterior a v5.252, y el MultiFileUploader v0.44 y anteriores, DuplicateEntry v1.2 y anteriores, MailPack v1.741 y anteriores, y el etiquetado automático v0.08 y anteriores plugins para Movable Type, permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para las peticiones que modifican los datos."
}
],
"lastModified": "2026-06-16T23:34:16.457",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:skyarc:autotagging:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "700A3014-4DD6-4694-A83E-C04267951C07",
"versionEndIncluding": "0.08"
},
{
"criteria": "cpe:2.3:a:skyarc:duplicateentry:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "943E5640-4B68-417A-B9DC-961029EBB604",
"versionEndIncluding": "1.2"
},
{
"criteria": "cpe:2.3:a:skyarc:mailpack:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6C36983-9CA0-4705-BBB2-77EFA831460A",
"versionEndIncluding": "1.741"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59C8DD6E-6645-43BC-8C62-7CBB750DB9D7",
"versionEndIncluding": "5.251"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D5A177C-9E80-4FBF-A443-8429142C0963"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A7E0117-F13D-48E5-A859-7C87C6F0FAA2"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B926DF53-7927-40E9-8565-F00BDFE06909"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.23:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BE6725E4-D378-4EA6-983F-9C00A02F8B56"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.24:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A3CD3BC-4D14-4924-8C9D-6F9046CAB9FA"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.24:*:enterprise:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D17F47AC-2B96-4D1B-932F-95E6852D7217"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.24:*:smart:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B0CB190-C55D-4D58-9A64-A23D3C106B99"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.25:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC5216DB-FE4C-486D-8597-6BBE2AE0D01F"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.25:*:enterprise:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58360AF1-8638-4B63-9655-702DFCA8F872"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.25:*:smart:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5DBDC0FD-7679-4503-AAF2-01DD31FB1A00"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.251:*:enterprise:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33D411B2-A032-451F-868A-4FBE2D6A0352"
},
{
"criteria": "cpe:2.3:a:skyarc:mtcms:5.251:*:smart:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "820F9FD8-6948-4DC2-ADFF-E69CC758C6CE"
},
{
"criteria": "cpe:2.3:a:skyarc:multifileuploader:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89E4A66A-36C7-484E-B1C5-E8CB296A679A",
"versionEndIncluding": "0.44"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "vultures@jpcert.or.jp"
}