CVE:CVE-2010-3883
CNNVD:CNNVD-201010-080
CMS Made Simple(简称CMSMS)作为一款优秀的轻量级开源内容管理系统(CMS)。
CMS Made Simple 1.7.1及之前版本中的Change Group Permissions模块中存在跨站请求伪造漏洞。远程攻击者可以劫持任意用户请求修改权限的认证。
solution:Upgrade cmsmadesimple cms_made_simple to a higher version than 1.7.1,0.10,0.10.3,0.10.4,0.11,0.11:beta5,0.11:beta6,0.11.1,0.11.2,0.12,0.12:beta1,0.12:beta2,0.12.1,0.12.2,0.13:beta1,0.13:beta2,0.13:beta3,1.0,1.0:beta1,1.0:beta2,1.0:beta3,1.0:beta4,1.0:beta5,1.0:beta6,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.1,1.1:rc1,1.1:rc2,1.1:rc3,1.1.1,1.1.2,1.1.3.1,1.1.4.1,1.2,1.2:beta1,1.2:beta2,1.2:beta3,1.2:rc1,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.3,1.3:beta1,1.3:beta2,1.3.1,1.4,1.4:beta1,1.4:beta2,1.4.1,1.5,1.5:beta1,1.5.1,1.5.2,1.5.3,1.5.4,1.6,1.6.1,1.6.2,1.6.3,1.6.4,1.6.5,1.6.6,1.6.7,1.6.8,1.7,and avoid the version (,1.7.1],0.10,0.10.3,0.10.4,0.11,0.11:beta5,0.11:beta6,0.11.1,0.11.2,0.12,0.12:beta1,0.12:beta2,0.12.1,0.12.2,0.13:beta1,0.13:beta2,0.13:beta3,1.0,1.0:beta1,1.0:beta2,1.0:beta3,1.0:beta4,1.0:beta5,1.0:beta6,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.1,1.1:rc1,1.1:rc2,1.1:rc3,1.1.1,1.1.2,1.1.3.1,1.1.4.1,1.2,1.2:beta1,1.2:beta2,1.2:beta3,1.2:rc1,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.3,1.3:beta1,1.3:beta2,1.3.1,1.4,1.4:beta1,1.4:beta2,1.4.1,1.5,1.5:beta1,1.5.1,1.5.2,1.5.3,1.5.4,1.6,1.6.1,1.6.2,1.6.3,1.6.4,1.6.5,1.6.6,1.6.7,1.6.8,1.7