CVE-2013-5313

EUVD-2013-5153
Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 31%
Affected Products (NVD)
VendorProductVersion
bigtreecmsbigtree_cms
𝑥
≤ 4.0
bigtreecmsbigtree_cms
4.0:b1
bigtreecmsbigtree_cms
4.0:b2
bigtreecmsbigtree_cms
4.0:b3
bigtreecmsbigtree_cms
4.0:b4
bigtreecmsbigtree_cms
4.0:b5
bigtreecmsbigtree_cms
4.0:b6
bigtreecmsbigtree_cms
4.0:b7
bigtreecmsbigtree_cms
4.0:rc1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/bigtreecms/BigTree-CMS/commit/4b0faa90fa8b9e1776c86db716894dcd7e6b4834
https://github.com/bigtreecms/BigTree-CMS/commit/4b0faa90fa8b9e1776c86db716894dcd7e6b4834