1. CVE-Search
  2. CVE-2007-3255
ID CVE-2007-3255
Summary Multiple cross-site request forgery (CSRF) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to execute commands as arbitrary users via (1) a saved Workflow name or (2) the Content-Type HTTP header. NOTE: item 2 also affects the same version numbers of Xythos Digital Locker (XDL). One or both vectors might also affect Xythos WebFile Server.
References
Vulnerable Configurations
  • cpe:2.3:a:xythos:enterprise_document_manager:*:*:*:*:*:*:*:*
    cpe:2.3:a:xythos:enterprise_document_manager:*:*:*:*:*:*:*:*
CVSS
Base: 6.5 (as of 16-10-2018 - 16:48)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:P/A:P
refmap via4
bid 24521
bugtraq 20070622 SYMSA-2007-004: Multiple Vulnerabilities in Xythos Server Products
misc http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-004.txt
osvdb
  • 37615
  • 37616
sectrack
  • 1018291
  • 1018292
secunia 25783
sreason 2845
xf xedm-multiple-csrf(35084)
Last major update 16-10-2018 - 16:48
Published 27-06-2007 - 18:30
Last modified 16-10-2018 - 16:48
Back to Top