CVE-2010-0709

MediumPublished

Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authentication of users or administrators...

Published: Feb 25, 2010
Updated: Aug 7, 2024
Assigning CNA: mitre
Evidence observed: Feb 16, 2010

Primary CVSS

6.8/ 10Medium

nvd · CVSS 2.0

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS probability estimate

1.2%

Low · next 30 days

Percentile: 68.1%
Model date: Oct 13, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authentication of users or administrators for requests that change the email address or password via the user action to index.php, and (2) hijack the authentication of the administrator for requests that create a new user via the admin/modules/user/new action to limny/index.php.

Sources

Limny 2.0 - Cross-Site Request Forgery (Change Email and Password)Exploit
Luis Santana · php · Feb 16, 2010
Limny 2.0 - Cross-Site Request Forgery (Create Admin User)Exploit
Luis Santana · php · Feb 16, 2010

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.