CVE-2018-7634

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse the functionality by attackers. By making a CSRF attack, an attacker could make a victim change his registered e-mail address on the application, leading to account takeover.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Enalean/tuleap/commit/0843c046eee54b16ec6a7753c575838212770189Patch
https://mustafairan.wordpress.com/2018/03/05/tuleap-mail-change-csrf-vulnerability-leads-to-account-takeover/Exploit, Patch, Third Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?p=tuleap%2Fstable.git&a=commit&h=d6701289ae55de900929ff0f66313fa9771a198dIssue Tracking, Patch, Vendor Advisory
https://tuleap.net/plugins/tracker/?aid=11217Patch, Vendor Advisory
https://twitter.com/Mustafaran/status/970745812887199744Exploit, Third Party Advisory
https://github.com/Enalean/tuleap/commit/0843c046eee54b16ec6a7753c575838212770189Patch
https://mustafairan.wordpress.com/2018/03/05/tuleap-mail-change-csrf-vulnerability-leads-to-account-takeover/Exploit, Patch, Third Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?p=tuleap%2Fstable.git&a=commit&h=d6701289ae55de900929ff0f66313fa9771a198dIssue Tracking, Patch, Vendor Advisory
https://tuleap.net/plugins/tracker/?aid=11217Patch, Vendor Advisory
https://twitter.com/Mustafaran/status/970745812887199744Exploit, Third Party Advisory

Timeline

Published: Mar 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-76355.3Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank CVE-2018-76366.1The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via speci CVE-2018-76377.8An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a differ CVE-2018-76387.8An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a differ CVE-2018-76397.8An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a differ CVE-2018-76407.8An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a differ CVE-2018-76417.8An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a differ CVE-2018-76425.5The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, all CVE-2018-76437.8The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and CVE-2018-76447.5The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allow CVE-2018-76489.8An issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which could overflow a buf CVE-2018-76496.1Monitorix before 3.10.1 allows XSS via CGI variables.