CVE-2013-7464

Published: 08 August 2018

In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used.

Priority

Medium

CVSS 3 base score: 8.8

Status

Package Release Status
cacti
Launchpad, Ubuntu, Debian
Upstream Not vulnerable
(0.8.8b+dfsg-6)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(0.8.8b+dfsg-6)
Ubuntu 16.04 LTS (Xenial Xerus) Not vulnerable
(0.8.8b+dfsg-6)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was not-affected [0.8.8b+dfsg-6])