« Volver al listado

CVE-2008-6657

Estado: ModificadaMedia (6.8)—

Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Simple Machines — Simple Machines Forum

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-6657",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-04-07T19:30:00.217",
  "references": [
    {
      "url": "http://osvdb.org/50071",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32516",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/32119",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.simplemachines.org/community/index.php?topic=272861.0",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46343",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6993",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/50071",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32516",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/32119",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.simplemachines.org/community/index.php?topic=272861.0",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46343",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6993",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en index.php en Simple Machines Forum (SMF) v1.0 anteriores a v1.0.15 y v1.1 anteriores a v1.1.7  permite a atacantes remotos secuestrar la autenticación de los administradores para realizar peticiones para instalar paquetes a través del parámetro \"package\" en una acción install2."
    }
  ],
  "lastModified": "2026-06-16T23:02:42.770",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "549FC613-BB72-42FD-AD04-0FAC2FC2A942"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1063E88-7F6D-4E42-B196-7292320C4F67"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F6A0089-3041-45E4-A1BB-F35A9039A12B"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.0.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E336DF9F-8978-44FD-9C1D-86F2C0E3AE2F"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.0.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8053CE57-37BF-4468-AD24-ECB1356779AF"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C381B85E-5A0F-4E32-A729-AB1E4A44A8E7"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE9DEB09-1A83-4AE0-B357-249E8C1F7988"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FBA0C02-402C-4E96-AADB-B0A1C397B982"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "449E930B-AB74-4B64-AC0A-C04A13C828B9"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D869E1D5-8E27-4A13-9FD7-8189B3AC9AC9"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44A73B71-B2AC-470D-A03C-BED3AAD81C1B"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABF69D49-AE48-4195-B958-A5D81AABD824"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FA54F25-0EF9-40B1-A9B6-77F15DD27A71"
            },
            {
              "criteria": "cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE14DC75-497A-4794-9260-E2A1291C9C6D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}