Vulnerability Description
Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal allows remote authenticated users to hijack the authentication of application users for requests that modify their personal data by leveraging lack of anti-CSRF tokens.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tejari | Bravo Solution | - |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2018/Feb/44ExploitMailing ListThird Party Advisory
- https://packetstormsecurity.com/files/146409/Tejari-Cross-Site-Request-Forgery.hExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/44256/ExploitThird Party AdvisoryVDB Entry
- https://www.securityfocus.com/archive/1/541782/30/0/threadedThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2018/Feb/44ExploitMailing ListThird Party Advisory
- https://packetstormsecurity.com/files/146409/Tejari-Cross-Site-Request-Forgery.hExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/44256/ExploitThird Party AdvisoryVDB Entry
- https://www.securityfocus.com/archive/1/541782/30/0/threadedThird Party AdvisoryVDB Entry
FAQ
What is CVE-2018-7216?
CVE-2018-7216 is a vulnerability with a CVSS score of 8.0 (HIGH). Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal allows remote authenticated users to hijack the authentication of application user...
How severe is CVE-2018-7216?
CVE-2018-7216 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-7216?
Check the references section above for vendor advisories and patch information. Affected products include: Tejari Bravo Solution.