CVE-2021-25930

MEDIUM Year: 2021
CVSS v3 Score
4.3
Medium
CVSS v2 Score
4.3
Medium
Weakness Type
CWE-352
View all →

Vulnerability Description

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.

Related Vulnerabilities

CVE-2005-1947

MEDIUM
CVSS:4.3(Medium)

Cross-site request forgery (CSRF) vulnerability in Invision Gallery before 1.3.1 allows remote attackers to delete albums and images as another user via a link or IMG tag to the (1) albums or (2) deli...

CWE-3522005

CVE-2014-10382

MEDIUM
CVSS:4.3(Medium)

The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.

CWE-3522014

CVE-2014-3655

MEDIUM
CVSS:4.3(Medium)

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

CWE-3522014

CVE-2015-10001

MEDIUM
CVSS:4.3(Medium)

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege us...

CWE-3522015

CVE-2015-10130

MEDIUM
CVSS:4.3(Medium)

The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail...

CWE-3522015

CVE-2015-9418

MEDIUM
CVSS:4.3(Medium)

The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.

CWE-3522015