CVE-2010-3603

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to hijack the authentication of administrators for requests that rename arbitrary files, as demonstrated by causing the user.config file to be moved, leading to a denial of service (service stop) and possibly the exposure of sensitive information.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/68060
http://packetstormsecurity.org/1009-advisories/moaub16-mojoportal.pdfExploit
http://packetstormsecurity.org/1009-exploits/moaub-mojoportal.txtExploit
http://secunia.com/advisories/41481Vendor Advisory
http://www.exploit-db.com/exploits/15018Exploit
http://www.mojoportal.com/mojoportal-2352-released.aspxPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/61834
http://osvdb.org/68060
http://packetstormsecurity.org/1009-advisories/moaub16-mojoportal.pdfExploit
http://packetstormsecurity.org/1009-exploits/moaub-mojoportal.txtExploit
http://secunia.com/advisories/41481Vendor Advisory
http://www.exploit-db.com/exploits/15018Exploit
http://www.mojoportal.com/mojoportal-2352-released.aspxPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/61834

Timeline

Published: Sep 24, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-36047.5SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands CVE-2010-36054.3Cross-site scripting (XSS) vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to inject arbitrary CVE-2010-36066.8Multiple directory traversal vulnerabilities in AGENTS/index.php in NetArt MEDIA Real Estate Portal 2.0 allow remote emote attackers to incl CVE-2010-36074.3Cross-site scripting (XSS) vulnerability in AGENTS/index.php in NetArt MEDIA Real Estate Portal 2.0 allows remote authenticated users to inj CVE-2010-36087.5Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) passwor CVE-2010-36095.0The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol CVE-2010-36114.3ISC DHCP server 4.0 before 4.0.2, 4.1 before 4.1.2, and 4.2 before 4.2.0-P1 allows remote attackers to cause a denial of service (NULL point CVE-2010-36134.0named in ISC BIND 9.6.2 before 9.6.2-P3, 9.6-ESV before 9.6-ESV-R3, and 9.7.x before 9.7.2-P3 does not properly handle the combination of si CVE-2010-36146.4named in ISC BIND 9.x before 9.6.2-P3, 9.7.x before 9.7.2-P3, 9.4-ESV before 9.4-ESV-R4, and 9.6-ESV before 9.6-ESV-R3 does not properly det CVE-2010-36155.0named in ISC BIND 9.7.2-P2 does not check all intended locations for allow-query ACLs, which might allow remote attackers to make successful CVE-2010-36165.0ISC DHCP server 4.2 before 4.2.0-P2, when configured to use failover partnerships, allows remote attackers to cause a denial of service (com CVE-2010-36184.3PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" func