CVE-2017-12970

High

Published: 23/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2017-12970 in Apache2Triad 1.5.4 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of authenticated users. Attackers can send requests that add or delete user accounts via phpsftpd/users.php.

Risk Assessment

This vulnerability poses a risk of unauthorized access to user accounts, potentially leading to data loss or unauthorized actions within the system.

Recommendation

It is recommended to update to the latest version of Apache2Triad and implement CSRF protection mechanisms, such as CSRF tokens in forms.

Other vulnerabilities in Apache2Triad 1.5.4

CVE-2017-12965Critical
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.

Original NVD description (English source)

Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for requests that (1) add or (2) delete user accounts via a request to phpsftpd/users.php.