$ cve CVE-2013-5954 JSON

CVE-2013-5954 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 3.1% (pctl 87)

Patch early

A public exploit exists.

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	3.09% — more likely to be exploited than 87% of all CVEs
Weakness	CWE-352
On CISA KEV	no
Public exploit	yes
Published	2014-04-25
Last modified	2026-06-16

Affected (2)

Vendor	Product
openx	openx
revive-adserver	revive adserver

Public exploits

Source	Title	Date
exploit-db	OpenX 2.8.x - Multiple Cross-Site Request Forgery Vulnerabilities	2014-03-15

References

→ the Explorer · watch your stack · NVD