Description
Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll, /account/protected/sub/delSub, or /message/updateAction to delete private messages and subscriptions or rename threads.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
banq jivejdon
Default version status: unaffected
0 to ≤ 5.0affected
References
- https://github.com/banq/jivejdon/issues/28 ↗
- https://github.com/banq/jivejdon ↗
- https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/WEB-INF/struts-config-shortmessage.xml#L112-L118 ↗
- https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/WEB-INF/struts-config-subscription.xml#L75-L79 ↗
- https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/message/UpdateThreadNameAction.java#L19-L36 ↗
- https://www.vulncheck.com/advisories/jivejdon-through-5.0-csrf-via-get-based-account-and-thread-actions ↗