CVE-2015-7715

moderate-risk

Published 2017-10-18

Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to hijack the authentication of administrators for requests that add a user via an add_user action to administrator/index.php.

Do I need to act?

0.14% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

38528

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (1)

Realtyna Property Listing

Affected Vendors

Realtyna

References (8)

Third Party Advisory http://packetstormsecurity.com/files/134067/Realtyna-RPL-8.9.2-CSRF-Cross-Site-S...

Vendor Advisory http://rpl.realtyna.com/change-logs/rpl7-changelog

Issue Tracking http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5271.php

Exploit https://www.exploit-db.com/exploits/38528/

Third Party Advisory http://packetstormsecurity.com/files/134067/Realtyna-RPL-8.9.2-CSRF-Cross-Site-S...

Vendor Advisory http://rpl.realtyna.com/change-logs/rpl7-changelog

Issue Tracking http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5271.php

Exploit https://www.exploit-db.com/exploits/38528/

/ 100

moderate-risk

Severity 30/34 · Critical

Exploitability 8/34 · Low

Exposure 5/34 · Minimal