Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authenti

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• atutor atutorup to 2.2.1 inclusive

Other highest-scoring records for the same primary product.

• CVE-2016-2555SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands v
  63This week
• CVE-2019-12169ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive t
  57Plan
• CVE-2017-1000002ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting
  48Plan
• CVE-2014-9753confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_logi
  40Plan
• CVE-2019-16114In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him
  40Plan
• CVE-2017-1000004ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email,
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

State-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use(session({ cookie: { httpOnly: true } }));2app.post("/account/address", updateAddress);

1app.use(session({ cookie: { httpOnly: true, sameSite: "lax" } }));2app.post("/account/address", csrfProtection, updateAddress);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.