| CVE-2011-5011 | Date: (C)2011-12-24 (M)2024-03-27 |
Multiple cross-site request forgery (CSRF) vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that (1) set a New user to Admin via the cID parameter to a statusconfirm action in admin/customers.php and (2) grant permissions to users via the cID parameter to a save action in admin/accounting.php.
CVSS Score and Metrics +CVSS Score and Metrics -| CVSS V2 Severity: |
| CVSS Score : 6.8 |
| Exploit Score: 8.6 |
| Impact Score: 6.4 |
| |
| CVSS V2 Metrics: |
| Access Vector: NETWORK |
| Access Complexity: MEDIUM |
| Authentication: NONE |
| Confidentiality: PARTIAL |
| Integrity: PARTIAL |
| Availability: PARTIAL |
| | |
