NuytsTech Security

CVE-2014-5100

by ·

Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS) sequences via the api_key_label parameter to admin/users/api-keys/1, or (3) disable file validation via a request to admin/settings/edit-security.

Date published : 2014-07-25

http://www.securityfocus.com/bid/68707

http://omeka.org/blog/2014/07/16/omeka-2-2-1-security-update-released

Tags: