Omeka Cross-Site Request Forgery (CSRF) Vulnerability - CVE-2014-5100 - Vulnerability Database

Omeka Cross-Site Request Forgery (CSRF) Vulnerability - CVE-2014-5100

Medium

Reference: CVE-2014-5100

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2014-5100

Title: Omeka Cross-Site Request Forgery (CSRF) Vulnerability

Overview:

Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add (2) insert cross-site scripting (XSS) sequences via the api_key_label parameter to admin/users/api-keys/1 or (3) disable file validation via a request to admin/settings/edit-security.