CVE-2011-4403: zen-cart zen_cart Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2011-4403 is a medium (CVSS 5.8) Cross-Site Request Forgery (CSRF) vulnerability in zen-cart zen_cart. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 24-04-2015
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.php.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.